Vulnerabilities

An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser.

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).

diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command via a GET request to enumerate LAN devices or crash the router with a DoS attack.

The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TELNET.

DASAN H660GW devices do not implement any CSRF protection mechanism.

The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/adv_nat_virsvr.asp Addr parameter (aka the Local IP Address field).

CVE-2018-10562 is an OS command injection flaw (CWE-78) in the web management interface of Dasan GPON home routers. When chained with the companion authentication bypass CVE-2018-10561, a remote, unauthenticated attacker can send crafted requests that execute arbitrary commands on the device. Successful exploitation yields full control of the router, enabling device takeover, botnet enrollment, and, per CISA, use in ransomware operations. Anyone operating an affected Dasan GPON router — many of which were deployed by internet service providers — is affected, and CISA notes the impacted products are end-of-life. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-03-31) with known ransomware use and a 100% EPSS probability of exploitation within 30 days.

Do: Because the product line is end-of-life and CISA's required action is to disconnect impacted devices if still in use, retire or replace affected routers rather than patching in place. If replacement must wait, block or firewall the web management interface from the internet, check the device for signs of compromise, and ensure the related authentication-bypass path CVE-2018-10561 is also closed.

Buffer overflow on Dasan GPON ONT WiFi Router H640X 12.02-01121 2.77p1-1124 and 3.03p2-1146 devices allows remote attackers to execute arbitrary code via a long POST request to the login_action function in /cgi-bin/login_action.cgi (aka cgipage.cgi).