{"id":"CVE-2018-10561","published":"2018-05-04T03:29:00Z","modified":"2026-06-17T01:34:10Z","title":"Dasan GPON Routers Authentication Bypass Vulnerability","vendor":"Dasan","product":"Gigabit Passive Optical Network (GPON) Routers","tier":"core","eol":null,"description":{"text":"An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending \"?images\" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.","provenance":"source","from":"NVD"},"summary":{"text":"The Dasan Gigabit Passive Optical Network (GPON) home routers contain an authentication bypass flaw in their web interface, classified as improper authentication. An attacker with network access to the device can append \"?images\" to a URL that normally requires login, such as /menu.html or /GponForm/diag_FORM, gaining full management control of the router without credentials and without any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:43Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.92818,"percentile":0.99829,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","ransomware":false,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-10561","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-05-07","exploitedFirstSeen":"2018-06-15","ransomware":true,"evidence":[{"url":"https://blog.netlab.360.com/botnets-never-die-satori-refuses-to-fade-away-en/","date":"2018-06-15"},{"url":"https://unit42.paloaltonetworks.com/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/","date":"2018-07-20"},{"url":"https://www.virusbulletin.com/virusbulletin/2019/12/vb2019-paper-absolutely-routed-why-routers-are-new-bullseye-cyber-attacks/#h4-analysis","date":"2018-12-18"},{"url":"https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_02B-3_Herwig_paper.pdf","date":"2019-01-01"},{"url":"https://www.trendmicro.com/en_us/research/19/e/new-mirai-variant-uses-multiple-exploits-to-target-routers-and-other-devices.html","date":"2019-05-23"},{"url":"https://blog.netlab.360.com/mozi-another-botnet-using-dht/","date":"2019-12-23"},{"url":"https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/","date":"2020-04-13"},{"url":"https://blog.radware.com/security/botnets/2020/05/whos-viktor-tracking-down-the-xtc-polaris-botnets/","date":"2020-05-07"},{"url":"https://blog.radware.com/security/botnets/2020/05/ghosting-bots-the-story-of-hoaxcalls-failures/","date":"2020-05-28"},{"url":"https://research.checkpoint.com/2020/rudeminer-blacksquid-and-lucifer-walk-into-a-bar/","date":"2020-09-15"}],"evidenceTotal":61,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://www.securityfocus.com/bid/107053","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44576/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/107053","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44576/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated bypass via crafted public-facing URL","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"It is possible to bypass authentication simply by appending","start":52,"end":111}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Bypass grants full device management access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"One can then manage the device","start":255,"end":285}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-ab60e18dfb72c1e085c0","title":"Matrix Unleashes A New Widespread DDoS Campaign","publisher":"aquasec.com","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","date":"2024-11-26","mentions":[{"quote":"However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).","start":7138,"end":7356},{"quote":"CVE-2018-10561: This vulnerability allows attackers to bypass authentication on GPON (Gigabit-capable Passive Optical Networks) routers using the Boa web server by appending certain parameters to the URL.","start":30223,"end":30427}]},{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"Microsoft researchers have also identified that previous reports have used the vulnerability ID “ZERO-32906” for CVE-2018-20057, “GPON” for CVE-2018-10561, and “DLINK” for CVE-2016-20017; and that CVE-2020-7209 was mislabeled as CVE-2017-17106 and CVE-2022-42013 was mislabeled as CVE-2021-42013.","start":4825,"end":5121},{"quote":"CVE-2018-10561","start":12016,"end":12030}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-2633","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2633","exploited":true,"exploitedSince":"2022-03-31","provenance":"source"},"exploits":[{"id":44576,"url":"https://www.exploit-db.com/exploits/44576","title":"GPON Routers - Authentication Bypass / Command Injection","type":"remote","platform":"hardware","date":"2018-05-03","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-05-03"},"first":{"date":"2018-05-03","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/44576"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/44576/","https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2018-05-03","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-44576)","url":"https://www.exploit-db.com/exploits/44576","provenance":"source"},{"date":"2018-05-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10561","provenance":"source"},{"date":"2018-06-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.netlab.360.com/botnets-never-die-satori-refuses-to-fade-away-en/","provenance":"source"},{"date":"2022-03-31","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-31","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2633","provenance":"source"},{"date":"2024-11-26","kind":"report","label":"Named in aquasec.com: Matrix Unleashes A New Widespread DDoS Campaign","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":1427},"priority":{"score":86.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3097 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}