9.8Kritik
KEV
CVE-2018-10561Dasan GPON Routers Authentication Bypass Vulnerability
Aktif olarak istismar ediliyor — Dasan GPON Routers Authentication Bypass Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 31.03.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 21.04.2022.
Gerekli işlem: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2018-10561
Açıklama
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.
Zayıflık türü (CWE):
CWE-287
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| dasannetworks | gpon router firmware | — |
Kaynaklar ve yamalar
- 107053 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 44576 exploitExploitThird Party AdvisoryVDB Entry
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/ ExploitTechnical DescriptionThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-10561 US Government Resource
CPE eşleşmeleri (NVD) (1)
cpe:2.3:o:dasannetworks:gpon_router_firmware:-:*:*:*:*:*:*:*