{"id":"CVE-2013-20009","kind":"vulnerability","aliases":["CVE-2013-20009"],"related":[],"title":"Linksys WAG200G router: stored XSS via policy_name runs in admin browsers","description":"Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.","summary":"Linksys WAG200G firmware through 1.01.06 lets an authenticated user save a malicious policy name through setup.cgi. The script runs in an administrator's browser when they open the Status > Wireless page.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-router","infrastructure","linksys","self-hosted","wag200g"],"not_affected_if":["no-wag200g","other-hardware"],"how_to_check":"- Check the firmware version on the device's status page against `1.01.06` or earlier\n- Look for an unexpected policy name containing script tags under the access restriction settings","fix":null,"status":"open","published_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:48+00:00","updated_at":"2026-10-28T03:32:48+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T03:32:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linksys WAG200G router: stored XSS via policy_name runs in admin browsers","impact":"medium","summary":"Linksys WAG200G firmware through 1.01.06 lets an authenticated user save a malicious policy name through setup.cgi. The script runs in an administrator's browser when they open the Status > Wireless page.","category":"infrastructure","nicknames":[],"who_cares":["linksys","wag200g","home-router","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Script runs in an admin's browser and can act as that admin on the router","analyst_note":"Check the vendor or NVD advisory for a fixed firmware version; the sources give none.","how_to_check":"- Check the firmware version on the device's status page against `1.01.06` or earlier\n- Look for an unexpected policy name containing script tags under the access restriction settings","needs_analyst":true,"not_affected_if":["other-hardware","no-wag200g"],"who_is_affected":"Owners of Linksys WAG200G routers running firmware through 1.01.06 where users with admin logins can reach the web interface. The sources do not say whether a fixed firmware exists. Networks without a WAG200G can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000571,"input_tokens":3338,"output_tokens":475,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-20009':15A,18A '-2013':14A,17A '1.01.06':32B,62C 'accessres.htm':94C 'admin':11A 'administr':49B,99C 'allow':72C 'attack':74C,85C 'authent':35B,73C 'browser':12A,51B,100C 'contain':63C 'cross':67C 'cross-sit':66C 'cve':13A,16A 'execut':97C 'firmwar':30B 'home':20B 'home-rout':19B 'host':26B 'infrastructur':22B 'inject':76C 'let':33B 'linksi':1A,23B,28B,59C 'malici':39B,89C 'name':8A,41B,81C,91C 'open':54B 'page':58B,95C,106C 'paramet':82C 'polici':7A,40B,80C,90C 'router':3A,21B 'run':9A,46B 'save':37B,87C 'script':45B,69C,77C 'self':25B 'self-host':24B 'setup.cgi':43B,84C 'site':68C 'status':56B,104C 'store':4A,65C 'user':36B 'via':6A,78C 'view':102C 'vulner':70C 'wag200g':2A,27B,29B,60C 'wireless':57B,105C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Owners of Linksys WAG200G routers running firmware through 1.01.06 where users with admin logins can reach the web interface. The sources do not say whether a fixed firmware exists. Networks without a WAG200G can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2013-20009","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-20009","severity":null,"published_at":"2026-10-28T03:17:07+00:00","modified_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}