CVE-2018-25318
Critical
Description
Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites.
SeverityCritical
CVSS9.8
Exploit probability—
ProductTenda Fh303 Firmware
PublishedApr 29, 2026
First seenApr 29, 2026
Weakness typeCWE-290CWE-290
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tenda fh303_firmware | 5.07.68_en | — |
| tenda a300_firmware | 5.07.68_en | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.