CVE-2018-25316

🗓️ 29 Apr 2026 19:24:44Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 7 Views🌐 WEB

Tenda W308R v2 V5.07.48 cookie session weakness enables unauthenticated DNS changes via crafted language cookie.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2018-25316	29 Apr 202619:24	–	attackerkb
Circl	CVE-2018-25316	29 Apr 202620:27	–	circl
CNNVD	Tenda W308R 安全漏洞	29 Apr 202600:00	–	cnnvd
Cvelist	CVE-2018-25316 Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change	29 Apr 202619:24	–	cvelist
EUVD	EUVD-2018-21837	29 Apr 202619:24	–	euvd
NVD	CVE-2018-25316	29 Apr 202620:16	–	nvd
Positive Technologies	PT-2026-35999	29 Apr 202600:00	–	ptsecurity
Vulnrichment	CVE-2018-25316 Tenda W308R v2 V5.07.48 Cookie Session Weakness DNS Change	29 Apr 202619:24	–	vulnrichment

NVD

Vulners

Node

tenda w308r_firmwareMatch5.07.48

AND

tenda w308rMatch2.0

[
  {
    "vendor": "Tenda",
    "product": "W308R v2",
    "versions": [
      {
        "status": "affected",
        "version": "5.07.48"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Tenda",
    "product": "W308R v2",
    "versions": [
      {
        "status": "affected",
        "version": "5.07.48"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/tenda-w308r-v2-cookie-session-weakness-dns-change
exploit-db	www.exploit-db.com/exploits/44373

Parameter	Position	Path	Description	CWE
admin_language	header	goform/AdvSetDns	Unathenticated attacker can modify DNS settings by sending a GET request to goform/AdvSetDns with a crafted admin language cookie, exploiting insufficient session validation.	CWE-290

17 Jun 2026 01:55Current

5.3Medium risk

Vulners AI Score5.3

CVSS 49.3

CVSS 3.19.8

EPSS0.00651

SSVC

CWE-290