The vulnerability in Tenda FH303/A300 firmware V5.07.68_EN allows an attacker to craft an admin cookie and send a GET request to the /goform/AdvSetDns endpoint, thereby modifying the router’s DNS server settings. This weakness arises from insufficient session cookie validation (CWE‑290), enabling plain‑text manipulation of critical router configuration. The result is that the victim’s entire network traffic can be redirected to malicious or phishing sites, compromising confidentiality, integrity, and potentially availability of the local network.

Affected devices are Tenda FH303/A300 routers running firmware V5.07.68_EN. No other versions or build numbers are listed as impacted, so the risk applies specifically to routers with this exact firmware release.

The CVSS score of 9.3 classifies this issue as critical, and the EPSS score is not reported, while it is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication by delivering a crafted cookie to an exposed web interface, suggesting a network‑based attack vector that requires only internet connectivity to the router. Successful exploitation can permanently alter DNS settings until the firmware is updated, thus making this vulnerability a high‑priority threat for affected users.