{"id":"CVE-2018-10562","aliases":["EUVD-2018-2634","GHSA-6x97-cqx6-mvmq"],"status":"published","title":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host...","description":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99949,"percentile":0.99973,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2018-05-04T03:00:00Z","modified":"2026-06-17T01:34:10Z","kev":{"date_added":"2022-03-31","due_date":"2022-04-21","required_action":"The impacted product is end-of-life and should be disconnected if still in use.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-31"},{"source":"kev","since":"2022-03-31"}],"exploits":[{"source":"exploitdb","id":"EDB-44576","title":"GPON Routers - Authentication Bypass / Command Injection","type":"remote","platform":"hardware","date":"2018-05-03","url":"https://www.exploit-db.com/exploits/44576"},{"source":"pocgithub","id":"ExiaHan/GPON","title":"ExiaHan/GPON","date":"2018-05-07","url":"https://github.com/ExiaHan/GPON"},{"source":"pocgithub","id":"649/Pingpon-Exploit","title":"649/Pingpon-Exploit","date":"2018-05-15","url":"https://github.com/649/Pingpon-Exploit"},{"source":"pocgithub","id":"Choudai/GPON-LOADER","title":"Choudai/GPON-LOADER","date":"2018-05-17","url":"https://github.com/Choudai/GPON-LOADER"},{"source":"pocgithub","id":"c0ld1/GPON_RCE","title":"c0ld1/GPON_RCE","date":"2018-05-26","url":"https://github.com/c0ld1/GPON_RCE"},{"source":"pocgithub","id":"ATpiu/CVE-2018-10562","title":"ATpiu/CVE-2018-10562","date":"2018-06-06","url":"https://github.com/ATpiu/CVE-2018-10562"},{"source":"pocgithub","id":"tpdlshdmlrkfmcla/backdoor.mirai.helloworld","title":"tpdlshdmlrkfmcla/backdoor.mirai.helloworld","date":"2025-03-31","url":"https://github.com/tpdlshdmlrkfmcla/backdoor.mirai.helloworld"},{"source":"nuclei","id":"CVE-2018-10562","title":"Dasan GPON Devices - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10562.yaml"}],"products":[{"vendor":"dasan","product":"gigabit passive optical network (gpon) routers"},{"vendor":"dasannetworks","product":"gpon_router_firmware"}],"references":[{"url":"http://www.securityfocus.com/bid/107053","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44576/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10562"},{"url":"https://www.exploit-db.com/exploits/44576"},{"url":"https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router"},{"url":"https://github.com/advisories/GHSA-6x97-cqx6-mvmq"}],"sources":{"cve":[{"id":"CVE-2018-10562","description":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.","status":"published","published":"2018-05-04T03:00:00Z","modified":"2025-10-21T23:45:51.689Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:01.619448Z"}],"euvd":[{"id":"EUVD-2018-2634","description":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.","status":"published","published":"2018-05-04T03:00:00Z","modified":"2025-10-21T23:45:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-03-31","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-6x97-cqx6-mvmq","title":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host...","description":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.","status":"published","published":"2022-05-13T01:48:49Z","modified":"2025-10-22T00:31:36Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2018-10562","title":"Dasan GPON Routers Command Injection Vulnerability","description":"Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.","cwes":["CWE-78"],"kev":{"date_added":"2022-03-31","due_date":"2022-04-21","required_action":"The impacted product is end-of-life and should be disconnected if still in use.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2018-10562","description":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.","status":"published","published":"2018-05-04T03:29:00.287Z","modified":"2026-06-17T01:34:10.407Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:04:26.098615Z"}]}}