Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Tenda wireless routers allows attackers to change the device's DNS settings without needing to log in. This could redirect users to malicious websites, potentially compromising their online activities.
- Attackers can control where users go online.
- Network gateways are vulnerable.
- The issue is easily exploitable.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by sending a crafted GET request to the router's web interface. This request targets the DNS settings endpoint, leveraging an insufficient session validation flaw in the cookie handling. By manipulating the cookie, an attacker can redirect all network traffic through their chosen DNS servers.
- Attacker sends malicious request.
- Targets router DNS settings.
- Unauthenticated access required.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Tenda routers allows unauthenticated attackers to redirect user traffic by modifying DNS settings via crafted cookie requests. Attackers are likely to target this vulnerability because it affects devices at the network edge, often with exposed management interfaces, enabling widespread redirection and potentially facilitating further attacks.
- Publicly available exploit code exists.
- The vulnerability impacts devices with commonly exposed interfaces.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate investigation of Tenda W3002R, A302, and W309R routers, specifically firmware version V5.07.64_en, for unauthorized DNS modification. Given the critical severity and public exploit availability, isolate or take affected devices offline if they are internet-facing and cannot be immediately patched or secured.
- Block access to `/goform/AdvSetDns` endpoint.
- Monitor network traffic for DNS changes.
- Update router firmware to a secure version.
