CVE-2018-10562

Description

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

References

https://thehackernews.com/2025/01/new-aquabot-botnet-exploits-cve-2024.html

https://www.bleepingcomputer.com/news/security/new-aquabotv3-botnet-malware-targets-mitel-command-injection-flaw/

https://www.akamai.com/blog/security-research/2025-january-new-aquabot-mirai-variant-exploiting-mitel-phones

https://www.cloudsek.com/blog/mozi-resurfaces-as-androxgh0st-botnet-unraveling-the-latest-exploitation-wave

https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/

https://www.exploit-db.com/exploits/44576/

http://www.securityfocus.com/bid/107053

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3