漏洞描述
Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
www.vpnmentor.comhttps://www.vpnmentor.com/blog/critical-vulnerability-gpon-router↗github.comhttps://github.com/f3d0x0/GPON/blob/master/gpon_rce.py↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2018-10562↗www.vpnmentor.comhttps://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/↗github.comhttps://github.com/ethicalhackeragnidhra/GPON↗