An issue was discovered on Dasan GPON home routers.

published 2018-05-04 8y ago modified 2026-06-17 4mo ago also EUVD-2018-2633

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2022-03-31
epss: 92.8%; EPSS 92.8% chance of exploitation in 30 days, percentile 99.8%
public exploits: 1; Exploit-DB

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Patch / fix

cisa required action The impacted product is end-of-life and should be disconnected if still in use.

Is CVE-2018-10561 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2018-05-03 First public exploit (EDB-44576)
2018-05-04 Published
2022-03-31 Added to CISA KEV
2022-04-21 CISA patch deadline
2025-02-03 CISA SSVC: exploitation active

Known exploited

Added: 4y ago (2022-03-31)
Patch by: 2022-04-21 (4y ago)
Ransomware: Not known
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Vendor, product: Dasan, Gigabit Passive Optical Network (GPON) Routers
CISA name: Dasan GPON Routers Authentication Bypass Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: last yr. (2025-02-03)

Exploit prediction

92.82% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-44576 GPON Routers - Authentication Bypass / Command Injection remote, 2018-05-03
vpnmentor.com https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-287 Improper Authentication

References

exploit-db.com /exploits/44576/
exploit, third-party-advisory, vdb-entry
vpnmentor.com /blog/critical-vulnerability-gpon-router/
exploit, technical-description, third-party-advisory
securityfocus.com /bid/107053
vdb-entry, broken-link, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561
government-resource, us-government-resource

Sources

CVE List CVE-2018-10561
NVD CVE-2018-10561

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed