Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting…
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Linksys
- Product
- WAG200G
- CVSS v3.1
- 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-78
- NVD status
- Received
Why it ranks 12 (Routine)
- CVSS v3.1 7.2 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2013-20007 on this site · NVD · CVE.org · Vulnpedia