Cookie Session Weakness in Tenda W3002R Wireless Router

Executive Summary

This vulnerability exists in Tenda W3002R/A302/W309R wireless routers version V5.07.64_en. It is a cookie session weakness that allows unauthenticated attackers to modify DNS settings. The issue arises from insufficient session validation, enabling attackers to send specially crafted GET requests to the /goform/AdvSetDns endpoint with a manipulated admin language cookie. This lets them change the primary and secondary DNS servers configured on the router.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for unauthorized GET requests to the /goform/AdvSetDns endpoint on Tenda W3002R/A302/W309R wireless routers running version V5.07.64_en.

Specifically, look for GET requests containing a crafted admin language cookie attempting to modify DNS settings.

Commands to detect such activity might include using network packet capture tools like tcpdump or Wireshark to filter HTTP GET requests to the vulnerable endpoint.

• tcpdump -i <interface> 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'
• Use Wireshark to filter HTTP requests with the filter: http.request.method == "GET" and http.request.uri contains "/goform/AdvSetDns"

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can have a severe impact as attackers can redirect your internet traffic by changing the DNS servers to malicious ones. This can lead to interception of sensitive data, phishing attacks, and exposure to malicious websites without your knowledge. Since the attack requires no authentication, it can be exploited remotely and easily, potentially compromising the confidentiality, integrity, and availability of your network communications.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to modify DNS settings on affected Tenda routers, redirecting user traffic to malicious DNS servers. Such unauthorized redirection can lead to interception and manipulation of sensitive data transmitted over the network.

Because attackers can intercept and manipulate network traffic without authentication, this poses a significant risk to the confidentiality and integrity of user data. This risk can impact compliance with data protection regulations such as GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and tampering.

Specifically, the vulnerability could lead to data breaches or exposure of personal health information or other regulated data, thereby violating the security requirements mandated by these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the router's administrative interface to trusted networks only.

Additionally, monitor and block unauthorized GET requests to the /goform/AdvSetDns endpoint.

If possible, update the router firmware to a version that addresses this cookie session weakness vulnerability.

As a temporary measure, consider resetting DNS settings to known safe values and changing any default credentials.

Useful 0 Not Useful 0