Dasan GPON Home Router Authentication Bypass Vulnerability (CVE-2018-10561) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTDasan GPON home routers
Attackers can completely bypass authentication to gain administrative control over the device, leading to unauthorized management and potential remote takeover
Apply the latest firmware updates immediately and restrict external WAN access to the device management interface
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest secure firmware version provided by the manufacturer. Upgrade the device firmware via the CLI or the web administration panel.
2. Temporary Workaround & Hardening Configuration
If patching is not immediately feasible, disable external WAN access to the web management ports (80, 443) using firewall rules. Below is an example of blocking external access using iptables:
# Block HTTP/HTTPS access from the external interface (e.g., eth0)
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP
# Allow access only from a trusted administration subnet and drop the rest
iptables -A INPUT -i eth0 -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP3. Log Audit & IoC Verification Commands
Inspect the web server access logs for suspicious requests containing the '?images' pattern to identify potential exploitation attempts.
# Search for authentication bypass attempts in web server logs
grep -Ei '(\?images|/GponForm/)' /var/log/httpd/access_log /var/log/nginx/access.log 2>/dev/null
# Extract source IPs and requested URIs associated with the exploit pattern
awk '/\?images/ {print $1, $6, $7, $8}' /var/log/httpd/access_log 2>/dev/nullStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2018-10561) is a critical authentication bypass vulnerability in the web management interface of Dasan GPON home routers. The root cause lies in the flawed implementation of the authentication verification logic within the built-in web server. The server incorrectly handles requests containing specific static resource paths, allowing authentication to be bypassed by simply appending '?images' to any restricted URL.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the target router. By appending '?images/' to a restricted URI, such as '/menu.html?images/' or '/GponForm/diag_FORM?images/', the web server's authentication filter is tricked into treating the request as a non-sensitive static image resource. Consequently, the server processes the request without validating the user's session, granting full administrative access to the specified page. This is frequently chained with command injection (CVE-2018-10562) to achieve remote code execution.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog, this vulnerability is actively exploited in the wild by botnets and malicious actors. Successful exploitation allows attackers to compromise the router, manipulate DNS settings to redirect traffic to malicious sites, and establish a foothold within the local network, posing severe risks to both enterprise and consumer environments.
Official Vendor Advisories & References
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.
Frequently Asked SecOps Questions (CVE-2018-10561)
FAQQ1. How critical is CVE-2018-10561 and is it actively exploited in the wild?
CVE-2018-10561 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 92.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2018-10561?
Primary impacted vendors include dasan across gpon home router. Scope summary: All Dasan GPON home routers running vulnerable firmware versions
Q3. What temporary mitigations or workarounds exist for CVE-2018-10561 before patching?
[Mitigation] Apply the latest firmware updates immediately and restrict external WAN access to the device management interface Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2018-10561
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (dasan)
View Category →Cisco Catalyst SD-WAN Peering Authentication Bypass Vulnerability (CVE-2026-20182)
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Manager (formerly vManage), and Validator (formerly vBond)
Check Point SmartConsole Authentication Bypass and Privilege Escalation Vulnerability (CVE-2026-16232) Advisory
[Affected Scope] Check Point Security Management Servers and SmartConsole instances exposed to the internet without Trusted Clients restrictions configured
Check Point Remote Access VPN and Mobile Access Authentication Bypass Vulnerability (CVE-2026-50751) Security Advisory
[Affected Scope] Check Point Remote Access and Mobile Access VPN gateways utilizing the deprecated IKEv1 key exchange protocol
Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.