Horizon Alert
Summary of the vulnerability and why it matters
A session weakness in Tenda router firmware allows unauthenticated attackers to change DNS settings. This can redirect user traffic to malicious websites, impacting the integrity of the network.
- Unauthenticated attackers can exploit this.
- Traffic can be rerouted to malicious sites.
- Affects consumer router firmware.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this flaw by sending a crafted GET request to the device's web interface to change DNS settings. This allows them to redirect users to malicious websites without any authentication.
- No authentication required.
- Targets router DNS settings.
- Redirects user traffic.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to alter DNS settings on Tenda routers, potentially redirecting user traffic. While it has been publicly known for some time, there is no strong indication of widespread active exploitation currently.
- Public exploit available.
- No recent exploitation signals.
- Affects consumer devices.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize immediate containment and monitoring for Tenda FH303/A300 routers running firmware v5.07.68_EN due to a critical vulnerability allowing unauthenticated DNS hijacking. Since a specific patch is not readily available, focus on preventing unauthorized access and detecting malicious network activity.
- Block known malicious IPs/domains.
- Monitor DNS traffic for anomalies.
- Restrict web interface access.
