CVE-2018-10562 PoC — Dasan GPON家庭路由器命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/iot/gpon-router-detect.yaml

Associated Vulnerability

Title: Dasan GPON家庭路由器命令注入漏洞 (CVE-2018-10562)
Description:An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.

Description

GPON home gateway device was detected. The "GPON Home Gateway" interface string belongs to Dasan-licensed firmware that is rebranded by many ISPs worldwide.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →