Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient…

CVE-2018-25316 affects Tenda W308R v2 V5.07.48 routers with a critical cookie session weakness vulnerability. The flaw allows unauthenticated attackers to bypass session validation and modify DNS settings without proper authentication. Attackers can exploit this by sending specially crafted GET requests to the goform/AdvSetDns endpoint with manipulated admin language cookies. This vulnerability enables attackers to change DNS server configurations, potentially redirecting user traffic to malicious sites for phishing or malware distribution. The weakness stems from insufficient session validation mechanisms in the router's web interface.