CVE-2013-20009
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
Risk Assessment
Execution of a malicious script in the administrator's browser can enable session theft or unauthorized actions within the device interface. This poses a risk of router takeover.
Recommendation
Update the device firmware to a non-vulnerable version or restrict access to the administrative interface. Validate and sanitize input and avoid untrusted policy names.
Other vulnerabilities in Linksys WAG200G
See all- CVE-2013-20008Medium
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
- CVE-2013-20007High
Linksys WAG200G contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Original NVD description (English source)
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS