CVE-2018-25316: Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change
Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect user traffic to malicious sites.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25316?
CVE-2018-25316 is considered a high severity vulnerability due to its impact on DNS settings through unauthenticated access.
How do I fix CVE-2018-25316?
To fix CVE-2018-25316, it is recommended to update the Tenda W308R v2 firmware to a version that addresses the cookie session weakness.
What impact does CVE-2018-25316 have on my network?
CVE-2018-25316 allows attackers to modify DNS settings, which can redirect users to malicious sites and compromise network security.
Who is affected by CVE-2018-25316?
CVE-2018-25316 affects users of the Tenda W308R v2 version V5.07.48 router.
Can CVE-2018-25316 be exploited remotely?
Yes, CVE-2018-25316 can be exploited remotely by unauthenticated attackers through specially crafted GET requests.