{"id":"CVE-2013-20008","kind":"vulnerability","aliases":["CVE-2013-20008"],"related":[],"title":"Linksys WAG200G router: admin password changeable without current password","description":"Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.","summary":"Linksys WAG200G firmware through 1.01.06 lets whoever holds an authenticated administrator browser session change the admin password without entering the current one. An attacker can lock the real administrator out and keep persistent control of the device.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","infrastructure","linksys","routers","self-hosted","wag200g"],"not_affected_if":["firmware-newer-than-1.01.06","no-admin-session-exposure"],"how_to_check":"- Check the firmware version on the device admin page against `1.01.06` or earlier\n- Confirm the model is WAG200G with `unknown` for any other hardware revisions","fix":"- No vendor fix is stated in the sources: unknown\n- Replace or isolate the device if no patched firmware exists\n- Restrict the admin interface to trusted hosts and change the admin password after any suspected session exposure","status":"open","published_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:35+00:00","updated_at":"2026-10-28T03:32:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T03:32:35Z","model":"claude-haiku-5-5","output":{"fix":"- No vendor fix is stated in the sources: unknown\n- Replace or isolate the device if no patched firmware exists\n- Restrict the admin interface to trusted hosts and change the admin password after any suspected session exposure","reach":"network","title":"Linksys WAG200G router: admin password changeable without current password","impact":"high","summary":"Linksys WAG200G firmware through 1.01.06 lets whoever holds an authenticated administrator browser session change the admin password without entering the current one. An attacker can lock the real administrator out and keep persistent control of the device.","category":"infrastructure","nicknames":[],"who_cares":["linksys","wag200g","routers","self-hosted","embedded"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes permanent admin control and locks out the owner","analyst_note":"Check NVD and vendor advisories for a fixed firmware build and confirm which hardware revisions are affected.","how_to_check":"- Check the firmware version on the device admin page against `1.01.06` or earlier\n- Confirm the model is WAG200G with `unknown` for any other hardware revisions","needs_analyst":true,"not_affected_if":["firmware-newer-than-1.01.06","no-admin-session-exposure"],"who_is_affected":"Owners of Linksys WAG200G routers running firmware through 1.01.06 that expose the web admin interface. The attack needs an already-authenticated administrator browser session, so networks where only trusted admins log in and the admin interface is not reachable from untrusted hosts are at lower risk.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3309,"output_tokens":582,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-20008':12A,15A '-2013':11A,14A '1.01.06':28B,64C 'access':86C 'admin':4A,39B 'administr':34B,52B,77C,90C,103C 'allow':72C 'attack':47B,73C,84C 'authent':33B,89C 'browser':35B,91C 'chang':37B,69C,75C 'changeabl':6A 'contain':65C 'control':57B,108C 'current':8A,44B,82C 'cve':10A,13A 'devic':60B,107C 'embed':16B 'enter':42B 'firmwar':26B 'hold':31B 'host':22B 'infrastructur':17B 'keep':55B 'legitim':102C 'let':29B 'linksi':1A,18B,24B,61C 'lock':49B,99C 'mechan':70C 'new':96C 'one':45B 'password':5A,9A,40B,68C,78C,83C,97C 'persist':56B,106C 'real':51B 'router':3A,19B 'self':21B 'self-host':20B 'session':36B,92C 'set':94C 'suppli':80C 'take':105C 'wag200g':2A,23B,25B,62C 'weak':67C 'whoever':30B 'without':7A,41B,79C","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys WAG200G routers running firmware through 1.01.06 that expose the web admin interface. The attack needs an already-authenticated administrator browser session, so networks where only trusted admins log in and the admin interface is not reachable from untrusted hosts are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2013-20008","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-20008","severity":null,"published_at":"2026-10-28T03:17:07+00:00","modified_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}