diff --git a/cves/2018/CVE-2018-10562.yaml b/cves/2018/CVE-2018-10562.yaml index 02b987a08b..b66f95704a 100644 --- a/cves/2018/CVE-2018-10562.yaml +++ b/cves/2018/CVE-2018-10562.yaml @@ -4,7 +4,7 @@ info: name: Dasan GPON Devices - Remote Code Execution author: gy741 severity: critical - description: Dasan GPON home routers are susceptible to command Injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping + description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. reference: - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router