CVE-2018-10562

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

• CWE-78
• CWE-78

• https://www.securityfocus.com/bid/107053Broken Link, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44576/Exploit, Third Party Advisory, VDB Entry
• https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/Exploit, Technical Description, Third Party Advisory
• https://www.securityfocus.com/bid/107053Broken Link, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/44576/Exploit, Third Party Advisory, VDB Entry
• https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/Exploit, Technical Description, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10562US Government Resource

Published

May 4, 2018

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1055Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-10550In Octopus Deploy before 2018.4.7, target and tenant tag var…
• CVE-2018-10553An issue was discovered in Nagios XI 5.4.13. A registered us…
• CVE-2018-10554An issue was discovered in Nagios XI 5.4.13. There is XSS ex…
• CVE-2018-1056An out-of-bounds heap buffer read flaw was found in the way …7.8
• CVE-2018-10561An issue was discovered on Dasan GPON home routers. It is po…9.8
• CVE-2018-10563An XSS in Flexense SyncBreeze affects all versions (tested f…
• CVE-2018-10564XSS exists in Flexense DiskPulse Enterprise from v10.4 to v1…
• CVE-2018-10565XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v1…
• CVE-2018-10566XSS exists in Flexense DupScout Enterprise from v10.0.18 to …
• CVE-2018-10567XSS exists in Flexense VX Search Enterprise from v10.1.12 to…
• CVE-2018-10568XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to…