Skip to content
CVSS 9.8 · CRITICAL

CVE-2018-25317

Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.

Ver en NVD

Análisis

This vulnerability affects specific Tenda wireless router firmware and allows unauthenticated attackers to hijack DNS settings. It is classified as not relevant because it targets niche consumer hardware firmware rather than the core software development tools or server infrastructure used by the community.

Severidad

Puntaje: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Tipo de falla (CWE): CWE-290

EPSS

Probabilidad de explotación (próx. 30 días): 0.0016 (0.2%)
Percentil: 36.5%
EPSS: 2026-05-06

Afecta

tenda:w3002r_firmwaretenda:w3002rtenda:a302_firmwaretenda:a302tenda:w309r_firmwaretenda:w309r

Descripción técnica

Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.

Publicada: 29/4/2026, 20:16:27
Última modificación: 5/5/2026, 2:46:59

Referencias

InicioEventosBlogRecursosEquipo