CVE-2018-10561VulnerabilityPublished 03/31/2022Updated 10/24/2026

CVE-2018-10561: Dasan GPON Routers Authentication Bypass Vulnerability

Affects Dasan Gigabit Passive Optical Network (GPON) RoutersSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/31/2022
KEV deadline: 04/21/2022
EPSS: 92.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

The impacted product is end-of-life and should be disconnected if still in use.

nvd.nist.gov/vuln/detail/CVE-2018-10561 (opens in a new tab)

Description

Dasan GPON Routers have an authentication bypass vulnerability (CVE-2018-10561). This flaw allows attackers to bypass authentication controls. When combined with CVE-2018-10562, it can enable remote code execution. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Summary

CVE-2018-10561 is an authentication bypass vulnerability in Dasan GPON Routers. This vulnerability allows an attacker to circumvent authentication mechanisms. Exploitation in conjunction with CVE-2018-10562 can lead to remote code execution on affected devices. The vulnerability is known to have been exploited in the wild, indicating active threat usage. No vendor advisory or patch information is available in the provided data.

Impact

Successful exploitation of this vulnerability can allow attackers to bypass authentication on Dasan GPON Routers, potentially leading to unauthorized access. When combined with CVE-2018-10562, it can result in remote code execution, allowing attackers to execute arbitrary code on the device. This can compromise the confidentiality, integrity, and availability of the affected routers.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Due to the lack of available patch information, users should monitor official Dasan communications for updates. Given the known exploitation in the wild, consider isolating affected devices and applying network-level protections where possible.

Weaknesses

CWE-287Improper Authentication (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:12:25 UTC

Weaknesses

References

Related threats