CVE-2018-10562

What it actually does

Unauthenticated command injection via the dest_host parameter in diag_action=ping requests to the GponForm/diag_Form URI; results are stored in /tmp and exposed when the user revisits /diag.html.

Why it matters to the business

Remote attackers can seize complete control of affected routers, enabling network interception, data theft, and deployment as ransomware or botnet infrastructure; high operational risk given documented ransomware use and CISA-mandated remediation deadline of 2022-04-21.

How an attack unfolds

An attacker crafts an HTTP request to the diag_Form endpoint embedding shell commands in dest_host, triggers execution during the ping operation, then retrieves output from /diag.html; the technique has been actively exploited in the wild by threat actors targeting Dasan GPON devices for initial access and persistence.

How to fix it

No firmware fixes are available; immediately replace Dasan GPON routers with supported alternatives, disable WAN management interfaces, and enforce network segmentation to limit exposure.

How to confirm the fix worked

Confirm device model and firmware are from the vulnerable Dasan GPON family; test whether diag_Form accepts arbitrary dest_host values and whether /diag.html leaks command output; verify replacement devices do not expose the same endpoints.

Typical attack path

1. Send unauthenticated HTTP POST to /GponForm/diag_Form containing diag_action=ping and command injection in dest_host
2. Wait for router to execute injected commands and store results in /tmp
3. Retrieve command output by requesting /diag.html
4. Escalate to persistent access, lateral movement, or ransomware deployment

How to detect it

Inspect web server or router logs for POST requests to GponForm/diag_Form with ping actions and suspicious dest_host values; examine /tmp for unexpected ping result files; review access logs to /diag.html immediately following diag_Form activity.

• /GponForm/diag_Form
• diag_action=ping
• dest_host=
• /diag.html
• /tmp/

What your security team should do

• Prioritize replacement of all Dasan GPON routers due to ransomware exploitation and missed CISA deadline
• Block or monitor traffic to /GponForm/diag_Form and /diag.html from untrusted networks
• Implement strict network segmentation around legacy router segments
• Hunt for historical indicators of compromise in logs and file systems