Command injection in GPON - CVE-2018-10562

Vulnerability identifier: #VU12661

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10562

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to command injection via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. A remote attacker can inject arbitrary commands and execute arbitrary code because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html.

GPON

Install update from vendor's website.

• Exploit #1948 - Pingpon-Exploit (Exploit for Mass Remote Code Execution on GPON home routers (CVE-2018-10562) obtained from Shodan.) (March 18, 2020)
• Exploit #1949 - GPON_RCE (Exploit for Remote Code Execution on GPON home routers (CVE-2018-10562) written in Python.) (March 18, 2020)
• Exploit #1954 - CVE-2018-10562 (Exploit for CVE-2018-10562) (March 18, 2020)
• Exploit #2145 - GPON-home-routers-Exploit (RCE on GPON home routers (CVE-2018-10561)) (March 18, 2020)
• Exploit #1941 - GPON (Exploit for Remote Code Execution on GPON home routers (CVE-2018-10562) written in Python. Initially disclosed by VPNMentor (https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/), kudos for their work.) (March 18, 2020)
• Exploit #1943 - GPON-LOADER (Exploit loader for Remote Code Execution w/ Payload on GPON Home Gateway devices (CVE-2018-10562) written in Python.) (March 18, 2020)
• Exploit #196 - labs (Vulnerability Labs for security analysis) (March 18, 2020)

• https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/

• Multiple vulnerabilities in Dasan GPON routers