CVE-2018-25317
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.
Ver en NVDAnálisis
This vulnerability affects specific Tenda wireless router firmware and allows unauthenticated attackers to hijack DNS settings. It is classified as not relevant because it targets niche consumer hardware firmware rather than the core software development tools or server infrastructure used by the community.
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCWE-290EPSS
Afecta
tenda:w3002r_firmwaretenda:w3002rtenda:a302_firmwaretenda:a302tenda:w309r_firmwaretenda:w309rDescripción técnica
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.