CVE-2018-10561

What it actually does

The flaw permits complete bypass of authentication checks on administrative web endpoints by appending the query string "?images" to any protected URI, resulting in unauthenticated access to device management functions including configuration changes and diagnostic execution.

Why it matters to the business

Compromised routers allow attackers to reconfigure network infrastructure, intercept traffic, or incorporate devices into larger botnets, leading to service outages, data exposure, and regulatory or operational costs; the vulnerability remains actively exploited in the wild with a past CISA remediation deadline.

How an attack unfolds

An attacker locates an internet-exposed Dasan GPON router, identifies any administrative web page that normally requires login, appends "?images" to the URL to evade authentication, gains full management control, and then alters settings or uses the device for further attacks.

How to fix it

No firmware fixes are available; immediately isolate affected routers from untrusted networks, replace with supported modern hardware, and enforce network segmentation or firewall rules that prevent direct internet exposure of management interfaces.

How to confirm the fix worked

Test by requesting protected administrative URIs both with and without the "?images" suffix from an unauthenticated client; successful bypass is confirmed when the same content is returned without credentials.

Typical attack path

1. Internet-wide scanning for exposed Dasan GPON router web interfaces
2. Selection of any URI normally protected by authentication
3. Appending the "?images" query parameter to bypass login enforcement
4. Obtaining unrestricted access to the management interface
5. Modification of device configuration, credential changes, or command execution

How to detect it

Review web server or device access logs for HTTP requests to administrative paths that include the "?images" query string, especially when originating from external addresses or lacking prior authentication events.

• /menu.html?images
• /GponForm/diag_FORM?images
• ?images/ HTTP/1.1
• GET.*\?images

What your security team should do

• Remove all internet-reachable Dasan GPON devices from production use
• Apply network access controls to block external management traffic
• Inventory and replace end-of-life GPON hardware with current supported models
• Monitor perimeter logs for any requests containing "?images" on router paths