CVE-2013-20009Medium· 4.8▾ SunlitLinksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the Ac…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 26.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
WAG200G <= 1.01.06Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2013-20008Medium· 6.8Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
CVE-2013-20007High· 7.2Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
CVE-2026-114576Low· 3.7Linksys RE6250 Web Management strcmp random values
CVE-2026-108896Critical· 9.9A vulnerability was found in Linksys E1700 1.0.0.4.003
CVE-2026-108895Critical· 9.9A weakness has been identified in Linksys E1700 1.0.0.4.003
CVE-2026-108894Critical· 9.9A security flaw has been discovered in Linksys E1700 1.0.0.4.003