CVE-2013-20007
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows…
- Risk score
- 43/100
- CVSS
- 7.2 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Last activity 28 Oct 2026. Patch Forecast updates every hour.