CVE-2018-10562

What is Dasan GPON?

GPON (Gigabit Passive Optical Network) routers are fiber-to-the-home modems deployed by internet service providers, primarily in Asia, Latin America, and the Middle East, to bridge residential fiber connections to in-home Ethernet and Wi-Fi. Dasan Networks (later merged into DASAN Zhone Solutions) was one of the largest suppliers of this class of equipment. Because these devices sit at the network edge and are provisioned directly by ISPs, they are internet-facing by default, rarely patched by end users, and represent an enormous, largely unmanaged attack surface — estimates at the time of disclosure put over a million affected units online.

Overview

CVE-2018-10562 is a command injection vulnerability in the Dasan GPON router web management interface. On its own it requires some level of access, but it becomes devastating when chained with CVE-2018-10561, an authentication bypass in the same firmware that lets an unauthenticated attacker reach restricted pages (including the diagnostic/ping utilities that are vulnerable to injection) by appending a string like ?images/ to any URL path. Together the two bugs allow a remote, unauthenticated attacker to execute arbitrary OS commands as root with a single crafted HTTP request.

Technical Details

The root cause (CWE-78, OS Command Injection) lies in diagnostic functions exposed through the web UI — such as ping/traceroute-style tools — that pass user-supplied parameters (e.g., an IP address or hostname field) directly into a shell command without sanitization. The companion authentication bypass exploits a flaw in how the device's HTTP server parses the request path: appending a fake image path tricks the server into treating an authenticated session as already established, exposing the entire configuration and diagnostic interface to unauthenticated requests. Chaining the two turns a local/authenticated bug into a fully remote, pre-auth root compromise — no user interaction, no credentials, low complexity.

Discovery

The vulnerability was identified and publicly disclosed by security researchers at vpnMentor in 2018, who published proof-of-concept exploit code alongside the auth-bypass companion bug.

Exploitation Context

Within days of disclosure, working exploit code was folded into the Satori/Mirai family of IoT botnets, and mass scanning for vulnerable GPON routers began almost immediately — this was one of the fastest weaponization timelines seen for a home-router bug at the time. CISA's KEV entry confirms the vulnerability has seen sustained real-world exploitation, and it remains listed under BOD 22-01's "disconnect if still in use" guidance because the affected Dasan hardware is now end-of-life with no further vendor support. Devices left in service continue to be recruited into botnets used for DDoS and further network pivoting.

Remediation

1. Identify any Dasan/DASAN GPON routers on your network — check ISP-provided CPE inventories, as these are often deployed transparently by carriers.
2. Because the affected models are end-of-life, request replacement hardware from your ISP rather than attempting to patch.
3. If replacement is not immediately possible, disable remote/WAN-facing administration on the device and restrict management access to a trusted LAN segment only.
4. Monitor egress traffic from GPON/ONT devices for signs of botnet check-in or unusual outbound scanning activity.
5. Treat any device that cannot be immediately replaced as compromised and rebuild or isolate it once replacement hardware arrives.