Dasan GPON Devices - RCE (CVE-2018-10562)
Description
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
psychologyCrowdSec Analysis
CVE-2018-10562 is a critical vulnerability affecting Dasan GPON home routers, allowing attackers to achieve remote code execution through command injection via a diagnostic web form.
CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.
CrowdSec network data shows that most actors exploiting CVE-2018-10562 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2018-10562 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attack attempts are typically directed at URLs containing /gponform/diag_form.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2018-05-04 |
| CISA KEV | 2022-03-31 |
| CISA Remediation Deadline | 2022-04-21 |
| Rule Released | 2023-12-15 |
| CrowdSec First Seen | 2024-11-23 |