CVE-2018-10561
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Dasan GPON Routers Authentication Bypass Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
Description
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 93% (percentile: 100) as of 1 November 2026
- CWE
- CWE-287
Affected products
dasannetworks: gpon router firmware; dasannetworks: gpon router
References
- https://www.exploit-db.com/exploits/44576/ ExploitThird Party AdvisoryVDB Entry
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ ExploitTechnical DescriptionThird Party Advisory
- https://www.exploit-db.com/exploits/44576/ ExploitThird Party AdvisoryVDB Entry
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ ExploitTechnical DescriptionThird Party Advisory
- http://www.securityfocus.com/bid/107053 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/107053 Broken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018… US Government Resource