CVE-2018-10561

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/107053Broken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44576/Exploit, Third Party Advisory, VDB Entry
https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/Exploit, Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/107053Broken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/44576/Exploit, Third Party Advisory, VDB Entry
https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/Exploit, Technical Description, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561US Government Resource

Timeline

Published: May 4, 2018
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 31, 2022
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-105629.8An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to CVE-2018-105636.1An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7).CVE-2018-105646.1XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7.CVE-2018-105656.1XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7.CVE-2018-105666.1XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.CVE-2018-105676.1XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7.CVE-2018-105686.1XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7.CVE-2018-105696.1An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.CVE-2018-10578.8On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LD CVE-2018-105704.8Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.CVE-2018-105716.1Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script CVE-2018-105726.5interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the n