CVE-2018-10561

Think of your router as the front desk of your business network—logins are the key that should keep outsiders from entering. This vulnerability acts like a trick that gets past the key: by adding a special "?images" bit to certain router URLs, an attacker can get in without a login and control the router. If your router is reachable from the internet or otherwise accessible, that means your network could be redirected, disrupted, or taken over.

This matters if your business uses Dasan GPON home routers that are still running. The key problem is that an attacker does not need a username or password to take remote control; no special clicks or actions from staff are required. This is only a risk if the router can be reached over the network in a way that allows an attacker to access its web URLs (and the router needs to be reachable based on your network exposure, since the default-config reachability is not known from the findings).

This is RED because CISA has it listed in the KEV (confirmed risk) and the remediation due date passed in April 2022, with the impacted product described as end-of-life. The weakness allows remote attackers to bypass authentication and manage the router, which can directly lead to network disruption or takeover.