CVE-2018-10562 is a command injection vulnerability in Dasan Gigabit Passive Optical Network (GPON) Routers. CISA added it to the Known Exploited Vulnerabilities catalogue on 31 March 2022, which means attackers have used it in real attacks. Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.
What this vulnerability means in a router
Command injection in a GPON router means attacker-supplied input can be interpreted as system commands instead of data. In networking gear, that matters because the device often sits at a high-trust boundary, exposing administrative functions, subscriber traffic handling, and remote management surfaces.
That combination makes the issue dangerous even before exploitation is chained with anything else. A command injection flaw can turn a single web request, management action, or crafted parameter into operating-system level execution on the appliance, which is why router bugs of this class are frequently treated as infrastructure compromise, not just application defects.
Why this specific CVE is operationally serious
The primary danger comes from the way this flaw can be combined with the router’s authentication bypass weakness. When a device accepts unauthenticated or improperly authenticated management input, command injection can become a direct route to takeover rather than a limited configuration bug.
That is the same general attack pattern discussed in Web Application Attacks Guide, where injection flaws let hostile input alter execution flow. Here, the target is not a business app, but an edge router whose compromise can expose traffic, configuration, and connectivity at once.
Because the CVE is in the KEV catalogue, organisations should treat it as a known-exploited exposure, not a theoretical weakness. The authoritative record should be checked in the CVE Program and the NIST National Vulnerability Database for canonical identification and advisory linkage.
How organisations check exposure and scope
Exposure assessment starts with asset inventory: identify whether any Dasan GPON routers exist, where they are deployed, and whether they are reachable from the internet or from broad internal management networks. Publicly reachable administration interfaces raise urgency, but internally reachable management paths can still be abused after phishing, VPN compromise, or lateral movement.
Then verify vendor guidance and affected-product statements rather than relying on name matching alone. Router families, firmware branches, and managed service deployments can differ, and operators often inherit devices through ISP, telco, or contractor relationships that obscure ownership.
For teams building a broader response process, the Vulnerability Management Guide is the right operational model: confirm scope, prioritise by exploitability and exposure, and validate that remediation actually removes the vulnerable condition.
Remediation, detection, and identity impact
Remediation should follow vendor guidance for the exact router model and firmware branch, with compensating controls used only when patching or replacement cannot happen immediately. Restrict administrative access, isolate management interfaces, and remove any unnecessary remote exposure until the device is no longer vulnerable.
Detection is equally important because exploitation of command injection may leave behind changed settings, added users, altered scripts, modified startup behaviour, or unusual outbound connections. Post-patch review should check whether the router was already used as a foothold for persistence or traffic interception.
If exploitation is confirmed or strongly suspected, rotate any credentials, tokens, certificates, or management secrets that the device could have exposed or reused. That matters because infrastructure compromise often creates secondary identity risk, especially where the router stores credentials for remote administration, monitoring, or service integration.
For a broader view of how access material and device compromise intersect, see HPE Aruba Instant On hard-coded credentials and Salt Typhoon telecom intrusions 2025, both of which show how network-device compromise can become a wider trust and access problem.
Risk and Threat Considerations
This vulnerability is dangerous because routers are both control planes and traffic conduits. If an attacker gains command execution, they may alter DNS, reroute traffic, harvest credentials, weaken monitoring, or persist in a position that is difficult to inspect from outside the device.
Failure mechanism: An authentication weakness can open the management surface, and command injection can then convert crafted input into shell or system execution, giving the attacker administrative control over the router.
Impact: The result can include device takeover, traffic redirection, credential exposure, service disruption, and a trusted foothold for further network compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while OWASP ASVS, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V5 — File Handling | Command injection is a classic input-to-execution failure pattern |
| Recommendation — Test input handling to prevent attacker-controlled parameters from reaching command execution. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Router command injection arises from unsafe handling of untrusted input |
| CM-7 — Least Functionality | Limiting router services reduces the attack surface for remote command abuse | |
| Recommendation — Validate management inputs before they can reach operating-system commands. Disable unnecessary services and management interfaces on exposed network appliances. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Routers require hardened configurations and controlled management exposure |
| Recommendation — Harden appliance settings and remove unnecessary administrative exposure. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Management endpoints on network devices fail when exposed or misconfigured |
| Recommendation — Secure management surfaces and verify only intended administrative paths are reachable. | ||
Practitioner Guidance
Why practitioners should care: Treat any KEV-listed router flaw as an exposure-management priority, not a routine patch item. Edge devices often sit outside normal endpoint tooling, so a vulnerable router can remain unnoticed even when server and workstation hygiene is strong.
What to watch for: Review management logs, configuration drift, unexpected admin accounts, and signs that the device is making connections or DNS requests it should not make. If you cannot trust the box, do not assume its logs or local state are clean.
Practitioner takeaway: For network appliances, remediation is only complete when the vulnerability is removed and the device has been checked for post-exploitation changes.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org