CVE-2018-10562

critical

Description

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

References

Exploits
More

https://thehackernews.com/2025/01/new-aquabot-botnet-exploits-cve-2024.html

https://www.bleepingcomputer.com/news/security/new-aquabotv3-botnet-malware-targets-mitel-command-injection-flaw/

https://www.akamai.com/blog/security-research/2025-january-new-aquabot-mirai-variant-exploiting-mitel-phones

https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave

https://www.exploit-db.com/exploits/44576/

https://github.com/ATpiu/CVE-2018-10562

https://github.com/c0ld1/GPON_RCE

https://github.com/649/Pingpon-Exploit

https://github.com/f3d0x0/GPON

https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2634

http://www.securityfocus.com/bid/107053

Details

Source: Mitre, NVD

Published: 2018-05-04

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.99949