Dasannetworks vulnerabilities
Published CVEs affecting Dasannetworks products: 3 record(s), with severity, exploitation and fixes.
CVE-2025-63206
Critical · 9.8
CWE-306 Nov 19, 2025
Missing Authentication for Critical Function in Dasannetworks Ds2924 Firmware
An authentication bypass issue was discovered in Dasan Switch DS2924 web based interface, firmware versions 1.01.18 and 1.02.00, allowing attackers to gain escalated privileges via storing crafted cookies in the web browser.
CVE-2018-10561
Critical · 9.8
KEV Urgent · 71 Public exploit CWE-287 May 4, 2018
Dasan GPON Routers Authentication Bypass Vulnerability
An issue was discovered on Dasan GPON home routers. It is possible to bypass authentication simply by appending "?images" to any URL of the device that requires authentication, as demonstrated by the /menu.html?images/ or /GponForm/diag_FORM?images/ URI. One can then manage the device.
CVE-2018-10562
Critical · 9.8
KEV Urgent · 85 Public exploit Ransomware CWE-78 May 4, 2018
Dasan GPON Routers Command Injection Vulnerability
An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to execute commands and retrieve their output.