CVE-2018-10562criticalunder attackransomwareCWE-78

CVE-2018-10562

Published · Updated

Follow this CVE+ Monitor Gigabit Passive Optical Network Routers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDMay 4
1st PoCMay 3
CISA KEV+1427d
Action required by CISAfederal deadline: 2022-04-21

The impacted product is end-of-life and should be disconnected if still in use.

In short

A security flaw in Dasan GPON routers allows attackers to run arbitrary commands by sending specially crafted ping requests to the router's web interface. An attacker can exploit this to take full control of the router and access sensitive information.

Technical detail

Command injection vulnerability in the dest_host parameter of diag_action=ping requests to GponForm/diag_Form endpoint. The vulnerability allows unauthenticated remote code execution due to insufficient input validation; attacker-controlled commands are executed server-side with router privileges, with output persisted in /tmp and retrievable via subsequent requests to /diag.html.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.