CVE-2018-25318: Tenda Router Vulnerability Allows DNS Hijacking

The National Vulnerability Database highlights CVE-2018-25318, a critical session weakness in Tenda FH303/A300 firmware V5.07.68_EN. This vulnerability, rated 9.8 CVSS, stems from insufficient cookie validation, enabling unauthenticated attackers to modify DNS settings. This isn’t just a configuration tweak; it’s a direct path to full traffic redirection.

Attackers can exploit this by sending crafted GET requests to the /goform/AdvSetDns endpoint with a fabricated admin cookie. The lack of proper session validation means they don’t need to authenticate. Once DNS settings are altered, all user traffic passing through the affected router can be rerouted to malicious sites, facilitating phishing, malware distribution, or credential theft. This is a classic man-in-the-middle scenario at the network edge.

While the National Vulnerability Database does not specify affected products beyond the firmware version, the impact is clear: any organization or individual using these specific Tenda router models is at severe risk. The attacker’s calculus here is simple: target a common, often unmanaged, edge device to gain broad control over user traffic with minimal effort, bypassing endpoint security controls entirely.