CVE-2018-10562

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
May 4, 2018
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 31, 2022
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-105636.1An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7).CVE-2018-105646.1XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7.CVE-2018-105656.1XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7.CVE-2018-105666.1XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.CVE-2018-105676.1XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7.CVE-2018-105686.1XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7.CVE-2018-105696.1An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.CVE-2018-10578.8On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDCVE-2018-105704.8Frog CMS 0.9.5 has XSS in /install/index.php via the ['config']['admin_username'] field.CVE-2018-105716.1Multiple reflected cross-site scripting (XSS) vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script CVE-2018-105726.5interface/patient_file/letter.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the nCVE-2018-105738.8interface/fax/fax_dispatch.php in OpenEMR before 5.0.1 allows remote authenticated users to bypass intended access restrictions via the scan