Is CVE-2018-10561 (Dasan GPON Routers Authentication Bypass) being exploited in the wild?

Yes. CISA added CVE-2018-10561 to its Known Exploited Vulnerabilities catalogue on 31 March 2022, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Dasan GPON Routers contain an authentication bypass vulnerability. Any organisation running the affected product should treat remediation as urgent. Check exposure first, then patch or mitigate, then review logs for signs of earlier compromise.

What Active Exploitation Means for CVE-2018-10561

An “exploited in the wild” determination changes the response from routine patch planning to urgent exposure management. For CVE-2018-10561, that means the first question is not whether the flaw is theoretically serious, but whether any Dasan GPON router is still reachable, internet-exposed, or present in a branch, small office, or unmanaged edge segment that may have escaped normal asset visibility.

Because CISA has placed the CVE in KEV, organisations should treat it as a confirmed exploitation risk and prioritize it ahead of unconfirmed vulnerabilities with similar age or severity. A practical first pass is to confirm product presence, identify any externally reachable management interface, and determine whether the device sits on a trust boundary where compromise would expose internal routing, remote management, or downstream network access.

If you need a broader playbook for confirmed exploitation cases, use the Zero-Day and Exploited Vulnerabilities Guide as the response model: confirm exposure, shorten time to remediation, and verify whether the issue has already been used as an initial access path.

How to Triage, Patch, or Contain the Router Safely

Start with inventory and reachability, not with assumptions about patch state. If a device cannot be confidently identified, treat it as exposed until proven otherwise, especially if it is an older customer-premises router or remote-site appliance. In parallel, review whether the management plane is reachable from the public internet, from partner networks, or from broad internal ranges that would make exploitation easier.

If remediation can be applied immediately, do that first, then confirm the device is no longer exposed by testing the management surface again. If patching must wait, reduce exposure by isolating the device, limiting management access to trusted administrative sources, disabling unnecessary remote administration, and using compensating controls that shrink the attack surface rather than merely watching the device longer.

For prioritization discipline, the CISA Known Exploited Vulnerabilities Catalog is the authoritative trigger for urgent remediation, while the FIRST EPSS model helps place the CVE in a broader exploitation-likelihood queue when multiple issues are competing for attention.

What to Look for After Exposure Has Been Removed

Once the device is patched or removed from service, review logs and network telemetry for signs that the router was used as an access point before remediation. On network gear, compromise often shows up less as obvious malware and more as unusual administrative logins, configuration changes, new forwarding rules, abnormal outbound traffic, or a management session from an unfamiliar source.

Do not limit the review to the device itself. If the router sat on a path to other internal systems, check for follow-on access from the same source addresses, new credential use, or signs that the device was leveraged for lateral movement, persistence, or traffic redirection. If the router was exposed long enough to be probed repeatedly, assume the adversary may have attempted more than one login or exploit path.

If the investigation suggests any management-plane compromise, Vulnerability Management Guide and SonicWall SSL VPN account compromises 2025 are useful references for the post-exposure mindset: verify whether access was abused, not just whether the patch was applied.

Risk and Threat Considerations

Internet-facing routing and edge devices are attractive because they sit close to trust boundaries and are often overlooked in asset and logging coverage. An authentication bypass on that kind of device can turn a single exposed appliance into a foothold for configuration tampering, traffic interception, or access to adjacent internal services.

Failure mechanism: The vulnerability removes or weakens the authentication barrier on a device that may already be reachable from untrusted networks, allowing unauthorized administrative access or interaction with sensitive management functions.

Impact: The likely consequences include device takeover, hidden persistence through configuration changes, exposure of internal connectivity, and a broader compromise path if the router is used as a pivot into downstream systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation requires rapid identification and remediation of exposed devices.
Recommendation — Prioritise, patch, and verify exploited vulnerabilities as a top remediation queue.
NIST CSF 2.0	DE.CM-01 — Security Continuous Monitoring	Monitoring is needed to detect signs of exploitation and post-exposure activity on the router.
	RS.MA-1 — Incident Management	Confirmed exploitation calls for coordinated response, containment, and recovery actions.
Recommendation — Monitor edge devices and adjacent traffic for signs of compromise after exposure is identified. Escalate exploited-device findings into incident response and containment workflows.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The question is about confirmed exploited vulnerability exposure and verification.
	SI-2 — Flaw Remediation	Urgent patching or mitigation is the core response to an actively exploited flaw.
Recommendation — Scan for the vulnerable product, validate exposure, and track remediation to closure. Apply or mitigate the flaw quickly and confirm the fix removed the exploitable condition.

Practitioner Guidance

What to prioritise: Confirm whether any Dasan GPON routers are still deployed, externally reachable, or managed outside a tightly controlled admin path. If exposure exists, treat remediation as urgent even before you know whether exploitation has already occurred.

What to verify: After remediation, verify that the management surface is no longer reachable from untrusted networks and that logs cover the period when the device may have been exposed. If evidence is thin, widen the hunt to adjacent systems that the router could have reached.

Practitioner takeaway: For confirmed-exploitation flaws on edge devices, the real decision is not “patch or monitor”, it is “assume the boundary may already be weakened until you prove otherwise.”