# CVE-2018-10562: Dasan GPON Devices - RCE

> Live exploitation tracking for CVE-2018-10562 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2018-10562

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Dasannetworks Gpon_router
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** firewall

## Description

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

## CrowdSec analysis

[CVE-2018-10562](https://euvd.enisa.europa.eu/vulnerability/CVE-2018-10562) is a critical vulnerability affecting Dasan GPON home routers, allowing attackers to achieve remote code execution through command injection via a diagnostic web form.

CrowdSec has been tracking this vulnerability and its exploits since 15th of December 2023.

CrowdSec network data shows that most actors exploiting CVE-2018-10562 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2018-10562 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attack attempts are typically directed at URLs containing `/gponform/diag_form`.

## Timeline

- 2018-05-04: CVE Published. CVE-2018-10562 is published to NVD.
- 2022-03-31: CISA KEV. CVE-2018-10562 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-04-21: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2023-12-15: Rule Released. CrowdSec releases a rule to detect CVE-2018-10562 exploitation attempts against the CrowdSec Network.
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2018-10562 for the first time.

## References

- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10562.yaml
- https://www.exploit-db.com/exploits/44576/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2018-10562) follows observed exploitation activity for CVE-2018-10562. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.