Critical severity9.8NVD Advisory· Published Apr 29, 2026· Updated May 5, 2026

CVE-2018-25317

Description

Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Tenda/A302 Firmware
cpe:2.3:o:tenda:a302_firmware:5.07.64_en:*:*:*:*:*:*:*
Tenda/W3002r Firmware
cpe:2.3:o:tenda:w3002r_firmware:5.07.64_en:*:*:*:*:*:*:*
Tenda/W309r Firmware
cpe:2.3:o:tenda:w309r_firmware:5.07.64_en:*:*:*:*:*:*:*
Tenda/W3002Rllm-create
Range: = V5.07.64_en
Tenda/A302llm-create
Range: = V5.07.64_en
Tenda/W309Rllm-create
Range: = V5.07.64_en

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/44380nvdExploitThird Party AdvisoryVDB Entry
www.vulncheck.com/advisories/tenda-w3002r-a302-w309r-64-en-cookie-session-weakness-dns-changenvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000