Patchfirst
Patchfirst
CVE-2018-10562 KEVRansomwarePublic exploit Critical · 9.8 EPSS 99.9%

Dasan GPON Routers Command Injection Vulnerability

Dasan · Gigabit Passive Optical Network (GPON) Routers

Summary

A command injection flaw exists in the diagnostic ping function of Dasan Gigabit Passive Optical Network (GPON) routers, where the dest_host parameter sent in a diag_action=ping request to a GponForm/diag_Form URI is not properly neutralized. An attacker with network access to the device can send a crafted request requiring no authentication or user interaction, then retrieve the injected command's output by having the router's saved ping results displayed when the user revisits /diag.html.

Official description · NVD

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

Breakdown
83.7 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 42 days after disclosure. Public exploit code (Exploit-DB) was available 1 day before disclosure.

  1. Public exploit codeExploit-DB1 day before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+42 days
  4. Added to CISA KEVknown ransomware use; EU database agrees+4 yrs
  5. Named in a threat reportaquasec.com+7 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Unauthenticated web request exploits router's public-facing interface

Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

Command injection yields arbitrary OS command execution

it's quite simple to execute commands and retrieve their output
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2018-10562 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportAqua SecurityNov 2024

Reports are matched by finding the exact id CVE-2018-10562 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag (3 duplicates merged)

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562

Third Party Advisory 3

securityfocus.com/bid/107053exploit-db.com/exploits/44576/vpnmentor.com/blog/critical-vulnerability-gpon-router/
↑ ↓ chooseEnter openEsc close