Security readout for executives and security teams
Plain-English summary
CVE-2018-10562 is a critical command injection flaw in Dasan GPON home routers. A remote, unauthenticated attacker could run commands through the router’s ping diagnostic function and retrieve output later. CISA lists it in the Known Exploited Vulnerabilities catalog, so exposed devices should be treated as urgent.
Executive priority
Prioritize remediation for any exposed or business-critical GPON routers. The combination of unauthenticated remote command execution, critical severity, and CISA KEV listing makes this an immediate exposure-management issue, especially where devices are internet reachable or unsupported by the ISP/vendor.
Technical view
The issue is CWE-78 command injection through the dest_host parameter in a diag_action=ping request to GponForm/diag_Form. The router stores ping results in /tmp and returns them when /diag.html is revisited. The CVSS 3.1 score is 9.8: network reachable, low complexity, no privileges, no user interaction.
Likely exposure
Exposure is most likely on Dasan GPON home routers with reachable web diagnostic or management interfaces. The source bundle does not provide exact model, firmware, CPE, or version ranges, so inventory confirmation must come from device records, ISP/vendor guidance, and safe exposure review.
Exploitation context
CISA KEV status supports known exploitation. The source bundle also cites a public exploit reference, but this analysis does not rely on or reproduce exploit details. Internet-exposed router management surfaces raise risk because the CVSS vector requires no authentication or user interaction.
Researcher notes
Affected product metadata in the source bundle is incomplete despite the description naming Dasan GPON home routers. Avoid broad assumptions about all GPON equipment. Focus validation on confirmed Dasan devices, reachable diagnostic endpoints, firmware provenance, and CISA KEV-driven remediation tracking.
Mitigation direction
- Identify Dasan GPON routers in use, including ISP-managed home or branch devices.
- Remove internet exposure to router management and diagnostic interfaces wherever possible.
- Check vendor or ISP guidance for affected models, firmware, and replacement direction.
- Apply vendor-approved firmware updates or replace unsupported affected devices.
- Monitor for suspicious router configuration changes, unexpected processes, or unusual outbound traffic.
Validation and detection
- Confirm whether any Dasan GPON devices are present in the asset inventory.
- Verify model and firmware against vendor or ISP advisories when available.
- Review whether management or diagnostic web interfaces are reachable from untrusted networks.
- Check logs and network telemetry for signs of unexpected router command execution.
- Document unknown model or firmware status as unresolved exposure until confirmed.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-10562 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- 44576CVE reference · exploit, x_refsource_EXPLOIT-DB
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/CVE reference · x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.