CVE-2018-10561: Dasan GPON Routers Authentication Bypass Vulnerability

CVE-2018-10561 is an authentication bypass vulnerability in Dasan Gigabit Passive Optical Network (GPON) routers. It allows an attacker to circumvent normal login controls on the device. When combined with CVE-2018-10562, exploitation can enable remote code execution. These routers often sit at the edge of home or small-business networks, so a successful bypass can give an attacker a foothold on the local network and any devices behind it. The product is end-of-life; CISA advises disconnecting any remaining units.

How it works

The flaw belongs to CWE-287, improper authentication. In this class of weakness the device fails to correctly enforce identity checks before granting access to protected functions or interfaces. An attacker who can reach the router’s management surface can abuse the bypass to obtain privileges that should require valid credentials. Public detail on the exact request sequence or parameters is limited; defenders should treat any unauthenticated access to administrative or diagnostic endpoints as a potential abuse path and confirm specifics against the original vendor advisory. Once authentication is bypassed, the companion issue CVE-2018-10562 can be leveraged to achieve remote code execution, giving the attacker the ability to run arbitrary commands on the device.

Am I affected? How to find it in your systems

Dasan GPON routers are typically deployed by internet service providers as customer-premises equipment that terminates fiber connections. They appear in residential gateways, multi-dwelling units, and some small-office environments. Inventory steps include:

• Checking ISP-supplied equipment lists, asset databases, and network diagrams for Dasan GPON models.
• Scanning internal and external management interfaces (HTTP/HTTPS, Telnet, SSH) for device banners or web UI strings that identify Dasan GPON hardware.
• Reviewing DHCP, PPPoE, or optical-line-terminal records that may list the router’s MAC OUI or model identifiers.
• Confirming firmware and hardware revisions against the vendor advisory; exact affected versions are not restated here and must be verified from the original source.

Telemetry signs of exploitation may include unexpected administrative sessions, configuration changes, or command execution from untrusted source addresses. Because the product is end-of-life, any still-active unit should be treated as high risk regardless of observed traffic.

How to remediate

The definitive remediation is to remove the device from service. CISA’s required action states that the impacted product is end-of-life and should be disconnected if still in use. Replace it with a supported router or ONT supplied or approved by the service provider. If a vendor patch or firmware update was ever published for this CVE, apply it only after confirming the exact fixed version in the original advisory; do not assume any particular release number. After replacement, re-image or factory-reset any downstream equipment that may have been exposed, change all credentials that traversed the old device, and verify that management interfaces on the new gear are not reachable from untrusted networks.

If you can't patch immediately

Immediate disconnection is the preferred control. Where operational constraints force temporary continued use, apply these compensating measures:

• Segment the router onto an isolated VLAN or physically separate network so that compromise cannot reach critical internal assets.
• Block all inbound management access (web, SSH, Telnet, TR-069, etc.) at the upstream firewall or ISP edge; allow only the minimum required WAN protocols.
• If a web application firewall or reverse proxy sits in front of the management interface, consider virtual-patching rules that drop unauthenticated requests to sensitive paths—validate any such rules against the vendor advisory.
• Disable remote administration and any unused services on the device itself.
• Increase monitoring: alert on new connections to the router’s IP, unexpected reboots, or configuration drift, and retain packet captures of management traffic for later analysis.

These steps only reduce exposure; they do not eliminate the underlying authentication bypass. Plan replacement without delay.

If your data may have been exposed

Actively exploited authentication-bypass and remote-code-execution chains on edge routers frequently lead to network compromise and data theft. If the device was internet-facing or showed signs of unauthorized access, assume credentials, session tokens, or traffic that traversed it may have been observed. Rotate passwords, review firewall and endpoint logs for lateral movement, and consider a free exposure scan of your email addresses against known breach data sets to determine whether associated accounts appear in public dumps.