Horizon Alert
Summary of the vulnerability and why it matters
A weakness in Tenda W308R routers allows unauthenticated attackers to change DNS settings. This could redirect users to malicious websites, compromising their internet traffic.
- Attackers can modify DNS settings.
- Redirects users to malicious sites.
- Requires no authentication to exploit.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can gain control of a Tenda W308R v2 router by exploiting a session validation flaw in its cookie handling. By sending a crafted GET request with a manipulated admin language cookie to the specific endpoint, an attacker can alter the router's DNS settings. This allows them to redirect all network traffic through malicious DNS servers, facilitating man-in-the-middle attacks.
- Attackers exploit router's admin interface.
- Requires sending crafted HTTP requests.
- Targets insufficient session validation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability presents a clear path for attackers to hijack user traffic by manipulating DNS settings. The ease of exploitation, with unauthenticated access via crafted requests, makes it a potentially attractive target for widespread disruption or credential harvesting. The core issue is insufficient session validation on a critical administrative function.
- Publicly available exploit code exists.
- The vulnerability affects a router's management interface.
- Exploitation allows for DNS hijacking.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Tenda W308R v2 firmware version 5.07.48 to address the cookie session weakness that allows unauthenticated DNS hijacking. If immediate patching is not feasible, isolate affected devices from the network to prevent traffic redirection and monitor for any unauthorized DNS requests.
- Apply firmware update 5.07.48 or later.
- Block access to the `goform/AdvSetDns` endpoint.
- Monitor network traffic for suspicious DNS queries.
