CVE-2018-10561: Dasan GPON routers authentication bypass via URL suffix

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing, very high EPSS probability, public exploits, and no patch for an end-of-life device make this an urgent exposure.

What it is

Dasan GPON home routers can be accessed without authentication by appending "?images" to any protected URL, such as /menu.html?images/ or /GponForm/diag_FORM?images. This lets an unauthenticated remote attacker reach administrative functionality and manage the device. The flaw is rated critical and the affected product is end-of-life.

Impact

An attacker gains full administrative control of the router, including the ability to change configuration and manage the device. Because the device sits at the network edge, this can expose or redirect the connected network.

Attack surface

Reachable over the network via HTTP requests to the router's web interface; no authentication is required and no user interaction is needed. The CVSS vector confirms network access with no privileges or UI.

Exploitation

The vulnerability is listed in CISA KEV, has an EPSS 30-day probability of 0.92893 (99.8th percentile), and public exploit references exist on Exploit-DB and a technical writeup. No ransomware campaign use is documented.

What to do

• Disconnect or replace end-of-life Dasan GPON routers, as CISA directs; no vendor patch is available for this product.
• If the device must remain temporarily, block its web management interface from untrusted networks and restrict access to a trusted management segment.
• Place the router behind a firewall or access control list that denies inbound HTTP to the management interface.
• Monitor for and remove any unauthorized configuration changes if the device has been exposed.
• Inventory all Dasan GPON devices on the network and track them for decommissioning.

Detection

• Inspect HTTP request logs for URLs containing "?images" appended to protected paths such as /menu.html or /GponForm/diag_FORM.
• Alert on unauthenticated access to administrative endpoints on GPON router management interfaces.
• Monitor for unexpected configuration changes or new administrative sessions on these routers.
• Watch for outbound connections from the router to unknown hosts that could indicate compromise.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.