CVE-2013-20007
HighCVSS 7.2Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
Linksys WAG200G contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Risk Assessment
An authenticated attacker can gain full control of the network device, which may be used for further attacks within the internal network.
Recommendation
Update the firmware to a non-vulnerable version or, if no fix exists, restrict administrative access to the device interface and consider replacing the hardware.
Other vulnerabilities in Linksys WAG200G
See all- CVE-2013-20009Medium
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
- CVE-2013-20008Medium
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
Original NVD description (English source)
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS