Is CVE-2018-10562 (Dasan GPON Routers Command Injection) being exploited in the wild?

Yes. CISA added CVE-2018-10562 to its Known Exploited Vulnerabilities catalogue on 31 March 2022, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Dasan GPON Routers contain an authentication bypass vulnerability. Any organisation running the affected product should treat remediation as urgent.

How to confirm CVE-2018-10562 is not just reported, but actively exploited

The right question is not whether the CVE exists, but whether your environment still exposes the vulnerable Dasan GPON Routers and whether those devices are reachable in a way that makes exploitation practical. For an internet-facing router flaw, exposure can persist long after the original advisory if the device was never retired, isolated, or replaced.

For this exact class of issue, use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog as the authoritative sources for current remediation status. If the device is still in service, assume the exploitation window is meaningful until proven otherwise through inventory, configuration review, and validation of the actual firmware and management exposure.

Because the flaw is an authentication bypass followed by command injection, confirmation is not just a patch-status exercise. You also need to determine whether the router is directly exposed to the internet, reachable from untrusted internal segments, or being used as an administrative foothold inside a larger network.

Why command injection on an edge router changes the response

Command injection on a router is more serious than a typical application bug because the device sits at a high-trust boundary and often has broad visibility into traffic, DNS, routing, or upstream management access. If exploitation succeeds, the attacker may be able to run commands with device-level authority, which can turn a perimeter appliance into a pivot point.

This is why the direct answer matters operationally: a KEV listing means CISA has already judged the issue to have reliable evidence of active exploitation, not merely theoretical risk. That makes the flaw a live exposure problem, not a future hardening item. NIST National Vulnerability Database is useful for record-level identification, but KEV should drive priority when the question is exploitation in the wild.

Because CISA also links this CVE to ransomware activity, the practical concern is not only device compromise, but what the compromised router can enable next, such as credential capture, traffic redirection, reconnaissance, or lateral movement into systems that trust the router’s network position.

What to do if you cannot remediate the router immediately

If replacement or vendor remediation must wait, treat the device as a high-risk exception and reduce its blast radius. That usually means removing direct internet exposure, restricting management interfaces to tightly controlled admin paths, and isolating any system that depends on the router for privileged network reach.

If you are still running the device, keep an eye on any unexpected configuration changes, new admin sessions, unexplained reboots, outbound connections you did not approve, or signs that the router is proxying traffic in ways your baseline does not explain. Those are the kinds of conditions that matter most when exploitation is already known to be occurring.

Any delay should be paired with a concrete containment plan, not just a ticket. When a router bug is already in the KEV catalogue, “we will patch later” is only acceptable if you can show compensating controls, a short exception window, and a defined check for compromise before normal service resumes.

Risk and Threat Considerations

Exploited edge devices are attractive because they often sit outside normal application monitoring while still holding network privilege and administrative reach. An attacker who gets command execution on a router can use it as an access bridge, not just a one-off crash or denial-of-service vector.

Failure mechanism: The authentication bypass removes the normal access gate, and command injection gives the attacker a way to run device commands after initial access. That combination turns a perimeter device into a control plane compromise, especially if the router is directly reachable from the internet.

Impact: The likely consequences include unauthorized configuration changes, traffic interception or redirection, broader internal exposure, and in some cases the kind of foothold that supports ransomware staging or follow-on intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-4 — Secure Configuration of Enterprise Assets and Software	Edge-router exposure depends on hardened configuration and reduced attack surface.
	CIS-12 — Network Infrastructure Management	The issue concerns vulnerable network infrastructure that can be abused as a foothold.
Recommendation — Harden and isolate the router, then remove unnecessary external management exposure. Inventory, monitor, and promptly remediate vulnerable network devices.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	A known exploited CVE requires prioritized remediation and verification.
	AC-4 — Information Flow Enforcement	Compromise of a router can affect network traffic paths and trust boundaries.
Recommendation — Track the router flaw as an urgent remediation item and validate closure. Restrict traffic paths so the router cannot be used to redirect or intercept flows.
NIST CSF 2.0	PR.AA-05 — Assets are protected against unauthorized access	Active exploitation of an edge device is an unauthorized-access problem.
Recommendation — Limit router access paths and verify only authorized administration is possible.

Practitioner Guidance

What to verify: Confirm whether any Dasan GPON Routers remain deployed, whether management services are exposed beyond the intended admin path, and whether the device has already been removed from asset inventories or forgotten in a remote site.

Decision rule: If the device is still operational and cannot be immediately remediated, treat it as an emergency exposure, isolate it, and verify whether the environment has already been touched before you restore normal trust in the network path.

What good looks like: The router is either replaced or no longer reachable from untrusted networks, and the team can show a completed exposure check, remediation action, and post-change review rather than only a patch plan.

Practitioner takeaway: For KEV-listed router flaws, exploitation status should change your priority immediately, because the real risk is not the CVE label itself but the possibility that a perimeter device has already become an attacker-controlled foothold.