CVE-2018-10562: Dasan GPON Routers Command Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-31. EPSS: 99.9% chance of exploitation in the next 30 days.

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

Affected products

• Dasannetworks GPON Router Firmware: affected versions not specified

Published 2018-05-04. Last modified 2026-06-17.