CVE-2018-25318: Tenda a300 Firmware

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user traffic to malicious sites.

Affected products

• Tenda a300 Firmware: version 5.07.68_en only
• Tenda FH303 Firmware: version 5.07.68_en only

Published 2026-04-29. Last modified 2026-06-17.