Tenda Router DNS Hijacking via Cookie Session Weakness

hello@craftedsignal.io — Wed, 29 Apr 2026 20:16:27 +0000

Tenda W3002R, A302, and W309R wireless routers running firmware version V5.07.64_en are susceptible to a cookie session weakness (CVE-2018-25317). This vulnerability allows unauthenticated attackers to remotely modify DNS settings on the affected devices. The attack exploits insufficient session validation, enabling malicious actors to inject commands and redirect user traffic to attacker-controlled DNS servers. This poses a significant risk as it can lead to phishing attacks, malware distribution, and credential theft. Exploitation is straightforward, requiring only a crafted HTTP GET request, making it accessible to unsophisticated attackers. The vulnerability was reported in April 2026.

Attack Chain

An unauthenticated attacker identifies a vulnerable Tenda router with firmware V5.07.64_en.
The attacker crafts an HTTP GET request targeting the /goform/AdvSetDns endpoint.
The crafted GET request includes a malicious admin language cookie designed to bypass session validation.
The attacker injects modified DNS server addresses into the GET request parameters (primary DNS and secondary DNS).
The vulnerable router processes the malicious GET request without proper session validation.
The router updates its DNS settings to the attacker-specified DNS servers.
Users connected to the compromised router now resolve domain names through the attacker’s DNS server.
The attacker can redirect user traffic to malicious websites or intercept sensitive information.

Impact

Successful exploitation of CVE-2018-25317 allows attackers to perform DNS hijacking on vulnerable Tenda routers, potentially affecting all connected users. By controlling the DNS server, attackers can redirect users to phishing sites, distribute malware, or intercept sensitive communications. Given the ease of exploitation, a large number of routers could be compromised, leading to widespread disruption and data theft. The severity is heightened because no authentication is required to change the DNS settings.

Recommendation

Deploy the Sigma rule Detect Tenda Router DNS Setting Modification to monitor web server logs for requests to the /goform/AdvSetDns endpoint.
Apply network-level filtering to block connections to known malicious DNS servers based on threat intelligence feeds.
Although no firmware update is available, consider replacing end-of-life Tenda routers (W3002R/A302/W309R with V5.07.64_en) with more secure models.

Totolink A8000RU Command Injection Vulnerability (CVE-2026-7244)

hello@craftedsignal.io — Tue, 28 Apr 2026 09:16:17 +0000

A critical security vulnerability, identified as CVE-2026-7244, has been discovered in Totolink A8000RU router firmware version 7.1cu.643_b20200521. This flaw resides within the CGI handler, specifically in the setWiFiEasyGuestCfg function located in the /cgi-bin/cstecgi.cgi file. By manipulating the merge argument, a remote attacker can inject and execute arbitrary operating system commands on the affected device. The vulnerability is remotely exploitable and a proof-of-concept exploit has been publicly released, increasing the risk of widespread exploitation. This poses a significant threat as it allows for complete control over the device, potentially leading to data breaches, network compromise, and botnet recruitment.

Attack Chain

The attacker sends a malicious HTTP request to the /cgi-bin/cstecgi.cgi endpoint on the Totolink A8000RU router.
The request targets the setWiFiEasyGuestCfg function.
The attacker crafts the request to include a payload in the merge argument designed to inject an OS command.
The cstecgi.cgi script processes the request and passes the merge argument to a system call without proper sanitization.
The injected OS command is executed with the privileges of the web server.
The attacker gains arbitrary code execution on the router’s operating system.
The attacker can then install malware, change router settings, or use the router as a pivot point to attack other devices on the network.

Impact

Successful exploitation of CVE-2026-7244 grants an attacker complete control over the vulnerable Totolink A8000RU router. This can lead to a variety of malicious activities, including data exfiltration, denial-of-service attacks, and the installation of persistent backdoors. Given the availability of a public exploit, a large number of devices could be compromised quickly. This could result in widespread botnet infections, impacting home users and small businesses relying on these routers for network connectivity.

Recommendation

Monitor web server logs for requests to /cgi-bin/cstecgi.cgi with suspicious parameters in the query string, especially related to the merge argument to detect exploitation attempts (see rule: “Detect Totolink A8000RU Command Injection Attempt”).
Implement network intrusion detection system (NIDS) rules to identify malicious payloads being sent to the affected endpoint (see rule: “Detect Totolink A8000RU Command Injection - Network”).
Apply the Sigma rule “Detect Totolink A8000RU Command Injection in Logs” to your SIEM to identify successful command injection attempts based on web server logs.
Monitor for unusual process execution originating from the web server process, indicating potential exploitation.
Unfortunately, a patch is not available so consider migrating to a more secure router.

Router Vulnerability — CraftedSignal Threat Feed

Tenda Router DNS Hijacking via Cookie Session Weakness

Attack Chain

Impact

Recommendation

Totolink A8000RU Command Injection Vulnerability (CVE-2026-7244)

Attack Chain

Impact

Recommendation