{"id":"CVE-2013-20007","kind":"vulnerability","aliases":["CVE-2013-20007"],"related":[],"title":"Linksys WAG200G router: authenticated command injection gives full device control","description":"Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.","summary":"Linksys WAG200G firmware through 1.01.06 passes backtick-delimited input in the timer_interval parameter of setup.cgi to the operating system shell. An authenticated attacker can run commands, start telnetd or download and run a backdoor, and gain full control of the device.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WAG200G","fixed":[],"affected":"<= 1.01.06","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","end-of-life","infrastructure","linksys","router","self-hosted","wag200g"],"not_affected_if":["admin-not-exposed","auth-required","firmware-newer-than-1.01.06","other-models","remote-management-disabled"],"how_to_check":"Open the router admin page, Status, and read the firmware version: v1.01.06 or earlier is vulnerable. Check that remote management is off and the admin page is not reachable from the internet (a Shodan search for WAG200G lists exposed units).","fix":"No fix exists as far as sources say (researcher: no known solution; Linksys closed the case without a patch). Replace the device, or restrict the admin interface to a trusted LAN, disable remote management and change the default admin password.","status":"open","published_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:22+00:00","updated_at":"2026-10-28T03:33:15+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-28T03:32:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linksys WAG200G router: authenticated command injection gives full device control","impact":"high","summary":"Linksys WAG200G firmware through 1.01.06 passes backtick-delimited input in the timer_interval parameter of setup.cgi to the operating system shell. An authenticated attacker can run commands, start telnetd or download and run a backdoor, and gain full control of the device.","category":"infrastructure","nicknames":[],"who_cares":["linksys","router","wag200g","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker gets full control of the router, including a persistent backdoor.","analyst_note":"Check NVD and vendor for a fixed firmware version or end-of-life notice; sources give no fix.","how_to_check":"- Check the firmware version on the router's admin page and see whether it is `1.01.06` or earlier\n- Confirm whether the admin interface is reachable from the internet or untrusted networks","needs_analyst":true,"not_affected_if":["other-models","firmware-newer-than-1.01.06","admin-not-exposed"],"who_is_affected":"Owners of Linksys WAG200G routers running firmware through `1.01.06` are exposed. The attacker needs valid admin credentials for the web interface, so exposure is mainly where the admin interface is reachable from untrusted networks. Devices not running this model or firmware are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0006,"input_tokens":3331,"output_tokens":533,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check NVD and vendor for a fixed firmware version or end-of-life notice; sources give no fix.","search":"'-20007':13A,16A '-2013':12A,15A '1.01.06':36B,78C 'allow':86C 'attack':56B,88C,103C 'authent':4A,55B,87C 'backdoor':67B,120C 'backtick':39B,95C 'backtick-delimit':38B,94C 'command':5A,19B,59B,82C,91C 'command-inject':18B 'contain':79C 'control':10A,71B,124C 'craft':107C 'cve':11A,14A 'delimit':40B,96C 'devic':9A,74B,123C 'download':63B,116C 'end':22B 'end-of-lif':21B 'execut':90C 'firmwar':34B 'full':8A,70B,122C 'gain':69B,121C 'give':7A 'host':30B 'infrastructur':25B 'inject':6A,20B,83C,93C 'input':41B,97C 'interv':45B,101C 'life':24B 'linksi':1A,26B,32B,75C 'oper':51B 'os':81C 'paramet':46B,102C 'pass':37B 'post':108C 'request':109C 'router':3A,27B 'run':58B,65B,118C 'self':29B 'self-host':28B 'send':105C 'setup.cgi':48B,111C 'shell':53B 'start':60B,113C 'system':52B 'telnetd':61B,114C 'timer':44B,100C 'vulner':84C 'wag200g':2A,17A,31B,33B,76C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys WAG200G routers running firmware through `1.01.06` are exposed. The attacker needs valid admin credentials for the web interface, so exposure is mainly where the admin interface is reachable from untrusted networks. Devices not running this model or firmware are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2013-20007","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-20007","severity":null,"published_at":"2026-10-28T03:17:07+00:00","modified_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2013-20007:935","url":null,"severity":null,"published_at":"2026-10-28T03:33:15+00:00","modified_at":"2026-10-28T03:33:15+00:00","first_seen_at":"2026-10-28T03:33:15+00:00","fetched_at":"2026-10-28T03:33:15+00:00","note":"Read researcher advisory (bugtraq, Messner 2013-02): only v1.01.06 listed, 'no known solution', Linksys closed case; public PoC on Exploit-DB 24476. No vendor page found; device is old/EOL, no fix."}],"documents":[{"id":8894,"url":"https://lists.openwall.net/bugtraq/2013/02/11/6","title":"Bugtraq: Multiple Vulnerabilities in Linksys WAG200G (Michael Messner)","kind":"advisory","source":"analyst","text":"Researcher advisory 2013-02-11. Vulnerable: firmware v1.01.06. OS command injection via timer_interval in setup.cgi, authenticated. Solution: No known solution available. Linksys closed the case 2012-11-15.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":8895,"url":"https://www.exploit-db.com/exploits/24476","title":"Exploit-DB 24476: Linksys WAG200G Multiple Vulnerabilities","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}