CVE-2018-10562: Dasan GPON Routers Command Injection Vulnerability

CVE-2018-10562 is a command-injection weakness in Dasan Gigabit Passive Optical Network (GPON) routers. When paired with the related authentication-bypass issue tracked as CVE-2018-10561, it can let an unauthenticated attacker achieve remote code execution on the device. The product is end-of-life, has been observed in ransomware campaigns, and remains a practical risk wherever these routers are still reachable from untrusted networks.

How it works

The flaw belongs to CWE-78 (OS command injection). In this class of weakness, user-controlled input is passed to a system shell or command interpreter without adequate sanitization. An attacker who can reach the vulnerable interface supplies crafted input that the device executes with the privileges of the affected process. CISA notes that Dasan GPON routers also contain an authentication-bypass vulnerability; when the two issues are chained, the attacker can skip normal login controls and then inject commands, resulting in remote code execution. Exact request formats and parameters are not detailed here; defenders must confirm the precise attack surface against the original vendor advisory and any subsequent analysis.

Am I affected? How to find it in your systems

Dasan GPON routers are typically deployed as customer-premises or last-mile optical network equipment in broadband and ISP environments. They may appear on the WAN edge of small offices, multi-dwelling units, or service-provider access networks.

• Inventory network devices by management interface, SNMP sysDescr, HTTP/HTTPS banners, or asset-management records that list Dasan or GPON CPE.
• Because the product is end-of-life, any still-active unit should be treated as potentially vulnerable regardless of firmware revision; confirm exact status only against the vendor advisory.
• Look for unexpected outbound connections, new administrative accounts, or command-execution artifacts in device logs if logging is still enabled.
• External attack-surface scans that identify Dasan GPON management ports exposed to the internet are a high-priority finding.

How to remediate

CISA’s required action is unambiguous: the impacted product is end-of-life and should be disconnected if still in use. There is no supported vendor patch path. Replace the device with a currently maintained optical or broadband router from a vendor that still issues security updates. After removal, revoke any credentials or certificates that were stored on the old unit and verify that no residual management paths remain reachable.

If you can't patch immediately

Until the device can be taken offline and replaced, apply compensating controls that reduce exposure of the command-injection and authentication-bypass surfaces:

• Segment the router so that its management interfaces are unreachable from the internet or from untrusted internal segments; place it behind a firewall that permits only necessary transit traffic.
• If a web application firewall or reverse-proxy is in the path, consider virtual-patching rules that block anomalous parameter values commonly associated with command injection, while recognizing that such rules are incomplete without vendor-specific signatures.
• Disable remote management, TR-069, or any other administrative service that is not strictly required.
• Increase monitoring for authentication anomalies, unexpected process execution, and outbound connections that could indicate successful exploitation or ransomware staging.

If your data may have been exposed

Actively exploited vulnerabilities on edge devices frequently lead to full network compromise and data theft; this CVE has documented ransomware use. If the router may have been reachable by attackers, assume credentials, traffic, or downstream systems could have been affected. Rotate any secrets that traversed the device, review logs for lateral movement, and consider running a free exposure scan of your email addresses against known breach data sets to determine whether associated accounts appear in prior incidents.