# N/A
## 概述
Dasan GPON家庭路由器存在命令注入漏洞。攻击者可以通过向GponForm/diag_Form URI发送包含exploit Payload的`diag_action=ping`请求，在`dest_host`参数中触发命令注入。由于路由器会将ping结果保存在/tmp中，并在用户重新访问/diag.html时将结果发送给用户，这使得执行命令并获取其输出变得非常简单。
## 影响版本
暂无特定版本信息
## 细节
攻击者可以通过构造特殊的`dest_host`参数，在发送`diag_action=ping`请求时注入恶意命令。由于路由器将ping结果保存在/tmp目录中，并在用户重新访问/diag.html页面时返回这些结果，攻击者能够执行系统命令并获取其输出。
## 影响
此漏洞允许攻击者通过命令注入执行任意系统命令，从而可能获取敏感信息或控制路由器，带来严重的安全风险。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Exploit for Remote Code Execution on GPON home routers (CVE-2018-10562) written in Python. Initially disclosed by VPNMentor (https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/), kudos for their work. | https://github.com/f3d0x0/GPON | POC详情 |
| 2 | Exploit for Mass Remote Code Execution on GPON home routers (CVE-2018-10562) obtained from Shodan. | https://github.com/649/Pingpon-Exploit | POC详情 |
| 3 | Exploit loader for Remote Code Execution w/ Payload on GPON Home Gateway devices (CVE-2018-10562) written in Python. | https://github.com/Choudai/GPON-LOADER | POC详情 |
| 4 | Exploit for Remote Code Execution on GPON home routers (CVE-2018-10562) written in Python. | https://github.com/c0ld1/GPON_RCE | POC详情 |
| 5 | Exploit for CVE-2018-10562 | https://github.com/ATpiu/CVE-2018-10562 | POC详情 |
| 6 | Python exploit for Remote Code Executuion on GPON home routers (CVE-2018-10562). Initially disclosed by VPNMentor (https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/), kudos for their work. | https://github.com/ExiaHan/GPON | POC详情 |
| 7 | backdoor.mirai.helloworld cve2018-20561, cve-2018-10562 | https://github.com/mr-won/backdoor.mirai.helloworld | POC详情 |
| 8 | Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-10562.yaml | POC详情 |
| 9 | backdoor.mirai.helloworld cve2018-20561, cve-2018-10562 | https://github.com/user20252228/backdoor.mirai.helloworld | POC详情 |