Critical Command Injection in Dasan GPON Routers (CVE‑2018‑10562) Enables Remote Code Execution
What It Is – Dasan GPON routers contain an authentication‑bypass flaw (CVE‑2018‑10562). When chained with CVE‑2018‑10561, an unauthenticated attacker can inject commands and achieve remote code execution on the device.
Exploitability – Publicly disclosed; proof‑of‑concept code exists. The NVD rates the vulnerability CVSS 3.1 9.8 (Critical). No known mitigations aside from vendor‑issued firmware updates.
Affected Products – Dasan Gigabit Passive Optical Network (GPON) routers (all models listed in the vendor advisory).
Why It Matters for Trust & Control Assurance
- Third‑party device control – Network equipment supplied by an external vendor must be tracked, patched, and evidentially verified to satisfy access‑control and configuration‑management objectives.
- Continuous monitoring – Demonstrable, automated evidence that firmware versions are current is a core control‑assurance signal for auditors and enterprise buyers.
- Audit‑ready remediation – Documented patch‑deployment and validation provide defensible proof that the organization mitigates authentication‑bypass risks across its supply chain.
Recommended Actions
- Inventory all Dasan GPON routers and record current firmware versions.
- Apply the vendor’s security patch (or upgrade to the latest firmware) immediately.
- Update your asset‑management and patch‑tracking systems to capture the remediation as control evidence.
- Incorporate the device‑patch status into continuous monitoring dashboards for ongoing assurance.
Source: CISA KEV – CVE‑2018‑10562