From e547884d41a6d493bfed68ef23a7984d3dabb559 Mon Sep 17 00:00:00 2001 From: MostInterestingBotInTheWorld <98333686+MostInterestingBotInTheWorld@users.noreply.github.com> Date: Thu, 12 May 2022 15:42:18 -0400 Subject: [PATCH] Enhancement: cves/2018/CVE-2018-10562.yaml by mp --- cves/2018/CVE-2018-10562.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cves/2018/CVE-2018-10562.yaml b/cves/2018/CVE-2018-10562.yaml index 02b987a08b..b66f95704a 100644 --- a/cves/2018/CVE-2018-10562.yaml +++ b/cves/2018/CVE-2018-10562.yaml @@ -4,7 +4,7 @@ info: name: Dasan GPON Devices - Remote Code Execution author: gy741 severity: critical - description: Dasan GPON home routers are susceptible to command Injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping + description: Dasan GPON home routers are susceptible to command injection which can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output. reference: - https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router