Skip to content
CVSS 9.8 · CRITICAL

CVE-2018-25316

Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites.

View on NVD

Analysis

This vulnerability affects an old, specific model of Tenda home router. It is unlikely to impact professional developers or production server environments managed by the community.

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-290

EPSS

Probability of exploitation (next 30 days): 0.0016 (0.2%)
Percentile: 36.5%
EPSS: 2026-05-06

Affects

tenda:w308r_firmwaretenda:w308r

Technical description

Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites.

Published: 4/29/2026, 8:16:27 PM
Last modified: 5/4/2026, 6:42:37 PM

References

HomeEventsBlogResourcesTeam