CVE-2018-25318 affects Tenda FH303/A300 firmware V5.07.68_EN with a session weakness vulnerability. The flaw allows unauthenticated attackers to modify DNS settings through insufficient cookie validation. Attackers can exploit the /goform/AdvSetDns endpoint by sending GET requests with crafted admin cookies. This vulnerability enables DNS hijacking attacks to redirect user traffic to malicious sites. The weakness stems from inadequate session management and authentication controls in the router firmware.