Live › vulnerability › CVE-2013-20007
Go to dashboardLinksys WAG200G firmware through 1.01.06 passes backtick-delimited input in the timer_interval parameter of setup.cgi to the operating system shell. An authenticated attacker can run commands, start telnetd or download and run a backdoor, and gain full control of the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Owners of Linksys WAG200G routers running firmware through 1.01.06 are exposed. The attacker needs valid admin credentials for the web interface, so exposure is mainly where the admin interface is reachable from untrusted networks. Devices not running this model or firmware are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WAG200G | vendor | <= 1.01.06 | – |
v1.01.06 or earlier is vulnerableEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
This page as .md · .json · in your agent: get_signal("CVE-2013-20007")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.