Attack Chain

1. An attacker identifies a vulnerable Tenda FH303/A300 router running firmware V5.07.68_EN.
2. The attacker crafts a malicious HTTP GET request targeting the /goform/AdvSetDns endpoint.
3. The crafted GET request includes a forged admin cookie, bypassing authentication checks due to the session weakness.
4. The attacker sends the crafted GET request to the router’s management interface.
5. The router, due to insufficient cookie validation, accepts the forged cookie and processes the request.
6. The request modifies the DNS server settings on the router, replacing the legitimate DNS servers with attacker-controlled DNS servers.
7. Users connected to the router unknowingly use the attacker’s DNS servers for name resolution.
8. DNS requests are redirected to malicious IPs controlled by the attacker, potentially leading to phishing sites or malware downloads.

Impact

Successful exploitation of CVE-2018-25318 allows an attacker to perform DNS hijacking on affected Tenda routers. This can redirect users to malicious websites designed to steal credentials, distribute malware, or conduct other harmful activities. The vulnerability poses a critical risk to users of the affected routers, as it can compromise their online security and privacy. The CVSS v3.1 base score for this vulnerability is 9.8, highlighting its severity. The number of affected users is dependent on the number of deployed vulnerable devices.

Recommendation

• Monitor web server logs for requests to /goform/AdvSetDns with unusual parameters (Sigma rule: “Detect Tenda Router DNS Hijacking Attempt”).
• If possible, upgrade the router firmware to a version that patches CVE-2018-25318.
• Implement network segmentation to limit the impact of compromised devices.
• Consider using a reputable DNS service with built-in security features to mitigate the impact of DNS hijacking attacks.