{"id":"CVE-2018-10562","published":"2018-05-04T03:29:00Z","modified":"2026-06-17T01:34:10Z","title":"Dasan GPON Routers Command Injection Vulnerability","vendor":"Dasan","product":"Gigabit Passive Optical Network (GPON) Routers","tier":"core","eol":null,"description":{"text":"An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.","provenance":"source","from":"NVD"},"summary":{"text":"A command injection flaw exists in the diagnostic ping function of Dasan Gigabit Passive Optical Network (GPON) routers, where the dest_host parameter sent in a diag_action=ping request to a GponForm/diag_Form URI is not properly neutralized. An attacker with network access to the device can send a crafted request requiring no authentication or user interaction, then retrieve the injected command's output by having the router's saved ping results displayed when the user revisits /diag.html.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:23Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99949,"percentile":0.99973,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-03-31","dueDate":"2022-04-21","ransomware":true,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-10562","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-06-15","exploitedFirstSeen":"2018-06-15","ransomware":true,"evidence":[{"url":"https://blog.netlab.360.com/botnets-never-die-satori-refuses-to-fade-away-en/","date":"2018-06-15"},{"url":"https://unit42.paloaltonetworks.com/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/","date":"2018-07-20"},{"url":"https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_02B-3_Herwig_paper.pdf","date":"2019-01-01"},{"url":"https://www.trendmicro.com/en_us/research/19/e/new-mirai-variant-uses-multiple-exploits-to-target-routers-and-other-devices.html","date":"2019-05-23"},{"url":"https://blog.netlab.360.com/mozi-another-botnet-using-dht/","date":"2019-12-23"},{"url":"https://web.archive.org/web/20200319160240/https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/","date":"2020-01-08"},{"url":"https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/","date":"2020-04-13"},{"url":"https://blog.radware.com/security/botnets/2020/05/whos-viktor-tracking-down-the-xtc-polaris-botnets/","date":"2020-05-07"},{"url":"https://blog.radware.com/security/botnets/2020/05/ghosting-bots-the-story-of-hoaxcalls-failures/","date":"2020-05-28"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf","date":"2020-06-21"}],"evidenceTotal":1107,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://www.securityfocus.com/bid/107053","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44576/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/107053","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/44576/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated web request exploits router's public-facing interface","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI","start":52,"end":165}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Command injection yields arbitrary OS command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"it's quite simple to execute commands and retrieve their output","start":279,"end":342}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-ab60e18dfb72c1e085c0","title":"Matrix Unleashes A New Widespread DDoS Campaign","publisher":"aquasec.com","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","date":"2024-11-26","mentions":[{"quote":"However, the majority of the vulnerabilities center around IoT devices (CVE-2022-30525, CVE-2022-30075, CVE-2018-10562, CVE-2018-10561, CVE-2018-9995, CVE-2017-18368, CVE-2017-17215, CVE-2017-17106, and CVE-2014-8361).","start":7138,"end":7356},{"quote":"CVE-2018-10562: This vulnerability enables command injection on GPON (Gigabit-capable Passive Optical Networks) routers using the Boa web server through the Boa web server’s administrative interface.","start":29828,"end":30027}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-2634","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2634","exploited":true,"exploitedSince":"2022-03-31","provenance":"source"},"exploits":[{"id":44576,"url":"https://www.exploit-db.com/exploits/44576","title":"GPON Routers - Authentication Bypass / Command Injection","type":"remote","platform":"hardware","date":"2018-05-03","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-05-03"},"pocGithub":{"count":6,"skipped":0,"earliest":"2018-05-07","earliestUrl":"https://github.com/ExiaHan/GPON","repos":[{"name":"649/Pingpon-Exploit","url":"https://github.com/649/Pingpon-Exploit","stars":24,"created":"2018-05-15"},{"name":"c0ld1/GPON_RCE","url":"https://github.com/c0ld1/GPON_RCE","stars":4,"created":"2018-05-26"},{"name":"ATpiu/CVE-2018-10562","url":"https://github.com/ATpiu/CVE-2018-10562","stars":3,"created":"2018-06-06"},{"name":"Choudai/GPON-LOADER","url":"https://github.com/Choudai/GPON-LOADER","stars":2,"created":"2018-05-17"},{"name":"ExiaHan/GPON","url":"https://github.com/ExiaHan/GPON","stars":0,"created":"2018-05-07"}]},"nuclei":[{"id":"CVE-2018-10562","name":"Dasan GPON Devices - Remote Code Execution","severity":"critical","path":"http/cves/2018/CVE-2018-10562.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10562.yaml"}],"first":{"date":"2018-05-03","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/44576"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/44576/","https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2018-05-03","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-44576); later: PoC-in-GitHub 2018-05-07","url":"https://www.exploit-db.com/exploits/44576","provenance":"source"},{"date":"2018-05-04","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10562","provenance":"source"},{"date":"2018-06-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.netlab.360.com/botnets-never-die-satori-refuses-to-fade-away-en/","provenance":"source"},{"date":"2022-03-31","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-31","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2634","provenance":"source"},{"date":"2024-11-26","kind":"report","label":"Named in aquasec.com: Matrix Unleashes A New Widespread DDoS Campaign","url":"https://www.aquasec.com/blog/matrix-unleashes-a-new-widespread-ddos-campaign/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":1427},"priority":{"score":83.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3060 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 6 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}