Dasan GPON Routers Command Injection Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-31
• Known to be used in ransomware campaigns
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

CISA: Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 21 Apr 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• www.securityfocus.com/bid/107053Broken LinkThird Party AdvisoryVDB Entry
• www.exploit-db.com/exploits/44576ExploitThird Party AdvisoryVDB Entry
• www.vpnmentor.com/blog/critical-vulnerability-gpon-routerExploitTechnical DescriptionThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource