Live › vulnerability › CVE-2013-20009
Go to dashboardLinksys WAG200G firmware through 1.01.06 lets an authenticated user save a malicious policy name through setup.cgi. The script runs in an administrator's browser when they open the Status > Wireless page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Owners of Linksys WAG200G routers running firmware through 1.01.06 where users with admin logins can reach the web interface. The sources do not say whether a fixed firmware exists. Networks without a WAG200G can skip it.
No product ranges from the sources yet.
1.01.06 or earlierUnknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
This page as .md · .json · in your agent: get_signal("CVE-2013-20009")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.