Patchfirst
Patchfirst
CVE-2018-10561 KEVPublic exploit Critical · 9.8 EPSS 92.8%

Dasan GPON Routers Authentication Bypass Vulnerability

Dasan · Gigabit Passive Optical Network (GPON) Routers

Summary

The Dasan Gigabit Passive Optical Network (GPON) home routers contain an authentication bypass flaw in their web interface, classified as improper authentication. An attacker with network access to the device can append "?images" to a URL that normally requires login, such as /menu.html or /GponForm/diag_FORM, gaining full management control of the router without credentials and without any user interaction.

Official description · NVD

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Breakdown
86.0 / 100
Exploited
Yes, in CISA KEV
Reports
2
Tactics
4/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 42 days after disclosure. Public exploit code (Exploit-DB) was available 1 day before disclosure.

  1. Public exploit codeExploit-DB1 day before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+42 days
  4. Added to CISA KEVEU database agrees+4 yrs
  5. Named in a threat reportaquasec.com+7 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Valid Accounts T1078 Medium also Persistence, Privilege Escalation, Stealth
AI mapping from the description · primary impact

Bypass grants full device management access

One can then manage the device
From the official description (NVD) Original (opens in a new tab) ↗
Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Unauthenticated bypass via crafted public-facing URL

It is possible to bypass authentication simply by appending
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 205 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-10561 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Valid AccountsT107856 general rules
All 56 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 2 threat reports
2 reportsAqua SecurityMicrosoftNov 2024 · 1 undated

Reports are matched by finding the exact id CVE-2018-10561 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag (3 duplicates merged)

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561

Third Party Advisory 3

securityfocus.com/bid/107053exploit-db.com/exploits/44576/vpnmentor.com/blog/critical-vulnerability-gpon-router/
↑ ↓ chooseEnter openEsc close