CVE-2018-10561

What are Dasan GPON Routers?

Dasan (later DASAN Zhone Solutions/DZS) manufactures Gigabit Passive Optical Network (GPON) home routers widely deployed by internet service providers as customer-premises equipment for fiber-to-the-home connections. Millions of these devices were deployed globally, particularly through ISPs in regions with heavy fiber buildouts, and — like much consumer CPE — they were rarely patched or replaced by end users once installed, since firmware updates typically depend on either the ISP or an unmotivated homeowner.

Overview

CVE-2018-10561 is a critical authentication bypass vulnerability in Dasan GPON routers' web management interface. By appending a specific string to any URL on the device's web interface (a path-traversal-style bypass of the authentication check), an unauthenticated remote attacker can access administrative functionality without valid credentials. On its own this exposes device configuration and administrative pages; combined with the command injection vulnerability tracked as CVE-2018-10562, it forms a two-stage chain that allows full unauthenticated remote code execution.

Technical Details

The flaw is classified under CWE-287 (improper authentication): the router's web server fails to properly validate whether a request has passed authentication before granting access to protected endpoints, and a crafted URL path can trick the authentication check into being skipped entirely. This is a network-reachable, zero-interaction, zero-credential bug — a single crafted HTTP request is sufficient to bypass authentication, and when chained with the companion command-injection flaw, to run arbitrary commands as the router's underlying OS user.

Discovery

The vulnerability was publicly disclosed in 2018 by security researchers, with proof-of-concept exploit details published alongside the companion CVE-2018-10562 command injection bug, enabling rapid weaponization by opportunistic attackers almost immediately after disclosure.

Exploitation Context

This vulnerability chain was exploited at internet scale within days of public disclosure. Multiple Mirai-derived IoT botnets — including variants publicly tracked as Muhstik and other Mirai forks — incorporated the GPON authentication-bypass-plus-command-injection chain into their scanning and infection routines almost immediately, adding hundreds of thousands of exposed GPON routers to DDoS botnets. CISA's KEV catalog listing confirms this vulnerability has continued to see real-world exploitation.

Remediation

1. Apply vendor-provided firmware updates addressing CVE-2018-10561 and CVE-2018-10562 if still available for the specific device model.
2. Given the product's end-of-life status noted by CISA, disconnect or replace any Dasan/DZS GPON routers still running vulnerable firmware if a patch is unavailable.
3. Never expose the router's web management interface directly to the internet; restrict administrative access to the local network only.
4. Change default credentials on any GPON CPE still in service, even though this specific bypass does not require them.
5. Monitor for unusual outbound traffic from GPON CPE, which may indicate the device has already been recruited into a botnet.