This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2018-25317 | BDVDB-2026-329564 Detail

TendaW3002R

Description#

Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie to change primary and secondary DNS servers, redirecting user traffic to malicious DNS servers.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

  • CWE-290 Authentication Bypass by Spoofing

References#

Exploit#

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.