CVE-2018-10562: Dasan GPON router command injection via dest_host parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, no authentication or interaction required, KEV-listed with known ransomware use, and near-maximum EPSS probability.

What it is

Dasan GPON home routers accept the dest_host parameter in a diag_action=ping request to the GponForm/diag_Form URI without sanitizing it, allowing OS command injection. Because the router stores ping output in /tmp and serves it back at /diag.html, an attacker can run commands and read their results. The flaw is remotely reachable without credentials and carries a CVSS 3.1 base score of 9.8.

Impact

An attacker gains arbitrary command execution on the router, which can lead to full device compromise, traffic interception, and use of the device as a foothold into the local network. CISA notes the product is end-of-life and that the vulnerability has been used in known ransomware campaigns.

Attack surface

Reached over the network via an HTTP request to the GponForm/diag_Form URI with a crafted dest_host value; the CVSS vector shows no privileges or user interaction required. Output retrieval requires revisiting /diag.html, but the injection itself needs no authentication.

Exploitation

Listed in CISA KEV since 2022-03-31 with known ransomware campaign use, and EPSS 30-day probability is 0.99949 (percentile 0.99973). Public exploit code exists (Exploit-DB 44576) and references are tagged Exploit.

What to do

• Apply the vendor patch if any is available; CISA states the product is end-of-life, so replace or disconnect affected Dasan GPON routers.
• Block or restrict external access to the GponForm/diag_Form and /diag.html endpoints at the network edge.
• Segment or isolate GPON routers from sensitive internal networks and management planes.
• Monitor for and remove any unauthorized configuration or persistence left by prior compromise.
• Inventory deployed Dasan GPON devices and prioritize remediation or decommissioning.

Detection

• Search web or proxy logs for requests to GponForm/diag_Form with diag_action=ping and suspicious dest_host values containing shell metacharacters.
• Alert on access to /diag.html following such requests, which may indicate output retrieval.
• Monitor router or upstream traffic for outbound connections to unknown hosts consistent with command-and-control.
• Review device logs for unexpected command execution or file writes under /tmp.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.