CVE-2018-25318: Tenda FH303/A300 Auth Bypass Vulnerability

CVE-2018-25318 Overview

CVE-2018-25318 is a session weakness vulnerability affecting Tenda FH303/A300 firmware V5.07.68_EN. The vulnerability allows unauthenticated remote attackers to modify DNS settings on the router by exploiting insufficient cookie validation in the web management interface. By sending specially crafted GET requests to the /goform/AdvSetDns endpoint with a forged admin cookie, attackers can redirect user traffic to malicious DNS servers, enabling a wide range of downstream attacks including phishing and man-in-the-middle scenarios.

Critical Impact

Unauthenticated attackers can remotely modify router DNS settings, redirecting all network traffic through attacker-controlled servers without any authentication.

Affected Products

• Tenda FH303 firmware V5.07.68_EN
• Tenda A300 firmware V5.07.68_EN

Discovery Timeline

• 2026-04-29 - CVE-2018-25318 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2018-25318

Vulnerability Analysis

This vulnerability stems from improper authentication and session management within the Tenda router's web interface (CWE-290: Authentication Bypass by Spoofing). The firmware fails to properly validate session cookies when processing requests to the DNS configuration endpoint. This design flaw allows attackers to craft requests with arbitrary cookie values that the router accepts as valid administrative sessions.

The attack is particularly dangerous because it requires no prior authentication and can be executed remotely over the network. Once an attacker successfully modifies the DNS settings, all devices connected to the router will have their DNS queries redirected to attacker-controlled servers.

Root Cause

The root cause is insufficient cookie validation in the /goform/AdvSetDns endpoint. The firmware does not properly verify that the session cookie corresponds to a legitimately authenticated administrative session. Instead of maintaining and validating cryptographically secure session tokens, the router accepts crafted cookie values, allowing authentication bypass.

Attack Vector

The attack is executed over the network without requiring any user interaction. An attacker sends an HTTP GET request to the vulnerable endpoint with manipulated cookie headers. The attack flow involves:

1. Identifying a vulnerable Tenda FH303/A300 router on the network
2. Crafting an HTTP GET request to /goform/AdvSetDns with a spoofed admin cookie
3. Specifying malicious DNS server addresses in the request parameters
4. The router processes the request without proper session validation
5. DNS settings are modified to point to attacker-controlled servers

All network traffic from connected devices can then be intercepted or redirected to malicious sites. Technical details and proof-of-concept information can be found in the Exploit-DB #44381 entry and the VulnCheck Advisory.

Detection Methods for CVE-2018-25318

Indicators of Compromise

• Unexpected HTTP requests to /goform/AdvSetDns endpoint in router access logs
• DNS settings on the router changed to unknown or suspicious IP addresses
• Network traffic being routed through unfamiliar DNS servers
• User reports of being redirected to suspicious websites

Detection Strategies

• Monitor network traffic for HTTP requests targeting /goform/AdvSetDns from unauthorized sources
• Implement DNS monitoring to detect unauthorized changes to router DNS configurations
• Deploy network intrusion detection rules to flag requests with suspicious cookie patterns to Tenda router management interfaces
• Regularly audit router configurations for unexpected DNS server modifications

Monitoring Recommendations

• Enable logging on the router web management interface and forward logs to a SIEM solution
• Set up alerts for any configuration changes to DNS settings on network equipment
• Monitor outbound DNS traffic for queries to unexpected resolvers
• Implement network segmentation to restrict access to router management interfaces

How to Mitigate CVE-2018-25318

Immediate Actions Required

• Restrict access to the router's web management interface to trusted internal networks only
• Implement firewall rules to block external access to port 80/443 on the router management interface
• Regularly verify DNS settings on the router have not been modified
• Consider replacing affected devices with routers from vendors that provide security updates

Patch Information

No official patch information is available from the vendor. Tenda has not released a firmware update addressing this vulnerability. Users should consider migrating to alternative router solutions that receive regular security updates.

Workarounds

• Disable remote management access to the router entirely if not required
• Place the router behind a properly configured firewall that blocks unauthorized access to management interfaces
• Use a separate, hardened DNS solution for your network rather than relying on router-provided DNS
• Implement network access controls to limit which devices can communicate with the router management interface
• Monitor DNS settings periodically using automated scripts to detect unauthorized changes

The most effective long-term mitigation is to replace vulnerable Tenda FH303/A300 devices with routers from manufacturers that actively maintain firmware security.