CVE-2018-10561 is a significant security vulnerability affecting Dasan GPON home routers, which are widely used for providing fiber-optic internet. The vulnerability allows remote attackers to bypass the router's authentication mechanism by simply appending the string "?images" to any URL within the device's web interface. This bypass grants attackers full management access to the device without requiring any credentials.
The vulnerability is particularly critical as it affects over one million routers globally, making it a prime target for cybercriminals. Once an attacker gains access, they can manipulate the router's settings, redirect users to malicious websites, install malware, and even eavesdrop on network traffic. The compromised routers can also be used as part of a botnet for launching distributed denial-of-service (DDoS) attacks, similar to the infamous Mirai or Satori botnets.
The issue is compounded when combined with another vulnerability, CVE-2018-10562, which allows for command injection. Together, these vulnerabilities enable unauthenticated attackers to take complete control of the device and potentially the entire network. The routers save ping results in a temporary file and transmit them to the user upon revisiting a specific URL, making it easy for attackers to execute commands and retrieve their output.
Given the widespread use of these routers and the potential for severe security and privacy breaches, CVE-2018-10561 has been included in CISA's Known Exploited Vulnerabilities Catalog. The vulnerability poses a high risk to users, especially since the affected devices are often end-of-life and may not receive security updates.
| 