Search
Find a vulnerability
Search criteria
9 vulnerabilities found for WAG200G by Linksys
CVE-2013-20009 (GCVE-0-2013-20009)
Vulnerability from nvd – Published: 2026-10-28 02:03 – Updated: 2026-10-28 02:03
VLAI
EPSS
VEX
Title
Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
Summary
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
Severity
4.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.s3cur1ty.de/m1adv2013-016 | third-party-advisory |
| https://www.exploit-db.com/exploits/24476 | exploit |
| https://www.vulncheck.com/advisories/linksys-wag2… | third-party-advisory |
Impacted products
Date Public
2013-02-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAG200G",
"vendor": "Linksys",
"versions": [
{
"lessThanOrEqual": "1.01.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:linksys:wag200g:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.01.06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Messner"
}
],
"datePublic": "2013-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators\u0027 browsers when viewing the Status \u003e Wireless page."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:11.721Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "s3cur1ty Advisory m1adv2013-016: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.s3cur1ty.de/m1adv2013-016"
},
{
"name": "ExploitDB-24476: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/24476"
},
{
"name": "VulnCheck Advisory: Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-stored-xss-via-policy-name-parameter"
}
],
"title": "Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2013-20009",
"datePublished": "2026-10-28T02:03:11.721Z",
"dateReserved": "2026-10-27T21:50:43.346Z",
"dateUpdated": "2026-10-28T02:03:11.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2013-20008 (GCVE-0-2013-20008)
Vulnerability from nvd – Published: 2026-10-28 02:03 – Updated: 2026-10-28 02:03
VLAI
EPSS
VEX
Title
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
Summary
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
Severity
CWE
- CWE-620 - Unverified Password Change
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.s3cur1ty.de/m1adv2013-016 | third-party-advisory |
| https://www.exploit-db.com/exploits/24476 | exploit |
| https://www.vulncheck.com/advisories/linksys-wag2… | third-party-advisory |
Impacted products
Date Public
2013-02-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAG200G",
"vendor": "Linksys",
"versions": [
{
"lessThanOrEqual": "1.01.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:linksys:wag200g:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.01.06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Messner"
}
],
"datePublic": "2013-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:11.024Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "s3cur1ty Advisory m1adv2013-016: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.s3cur1ty.de/m1adv2013-016"
},
{
"name": "ExploitDB-24476: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/24476"
},
{
"name": "VulnCheck Advisory: Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-admin-password-change-without-current-password"
}
],
"title": "Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2013-20008",
"datePublished": "2026-10-28T02:03:11.024Z",
"dateReserved": "2026-10-27T21:50:43.346Z",
"dateUpdated": "2026-10-28T02:03:11.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2013-20007 (GCVE-0-2013-20007)
Vulnerability from nvd – Published: 2026-10-28 02:03 – Updated: 2026-10-28 02:03
VLAI
EPSS
VEX
Title
Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
Summary
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.s3cur1ty.de/m1adv2013-016 | third-party-advisory |
| https://www.exploit-db.com/exploits/24476 | exploit |
| https://www.vulncheck.com/advisories/linksys-wag2… | third-party-advisory |
Impacted products
Date Public
2013-02-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAG200G",
"vendor": "Linksys",
"versions": [
{
"lessThanOrEqual": "1.01.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:linksys:wag200g:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.01.06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Messner"
}
],
"datePublic": "2013-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:10.353Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "s3cur1ty Advisory m1adv2013-016: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.s3cur1ty.de/m1adv2013-016"
},
{
"name": "ExploitDB-24476: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/24476"
},
{
"name": "VulnCheck Advisory: Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-os-command-injection-via-timer-interval-in-setup-cgi"
}
],
"title": "Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2013-20007",
"datePublished": "2026-10-28T02:03:10.353Z",
"dateReserved": "2026-10-27T21:50:43.346Z",
"dateUpdated": "2026-10-28T02:03:10.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2007-1585 (GCVE-0-2007-1585)
Vulnerability from nvd – Published: 2007-03-21 23:00 – Updated: 2024-08-07 12:59
VLAI
EPSS
VEX
Summary
The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/23063 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/24658 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/463342/100… | mailing-listx_refsource_BUGTRAQ |
| http://marc.info/?l=bugtraq&m=117492736903388&w=2 | mailing-listx_refsource_BUGTRAQ |
Date Public
2007-03-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:59:08.805Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "linksys-udp-information-disclosure(33251)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"name": "23063",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23063"
},
{
"name": "24658",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24658"
},
{
"name": "20070320 Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"name": "20070325 Re: Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "linksys-udp-information-disclosure(33251)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"name": "23063",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23063"
},
{
"name": "24658",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24658"
},
{
"name": "20070320 Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"name": "20070325 Re: Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1585",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "linksys-udp-information-disclosure(33251)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"name": "23063",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23063"
},
{
"name": "24658",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24658"
},
{
"name": "20070320 Linksys WAG200G - Information disclosure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"name": "20070325 Re: Linksys WAG200G - Information disclosure",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1585",
"datePublished": "2007-03-21T23:00:00.000Z",
"dateReserved": "2007-03-21T00:00:00.000Z",
"dateUpdated": "2024-08-07T12:59:08.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-20009 (GCVE-0-2013-20009)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-10-28 02:03
VLAI
EPSS
VEX
Title
Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
Summary
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
Severity
4.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.s3cur1ty.de/m1adv2013-016 | third-party-advisory |
| https://www.exploit-db.com/exploits/24476 | exploit |
| https://www.vulncheck.com/advisories/linksys-wag2… | third-party-advisory |
Impacted products
Date Public
2013-02-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAG200G",
"vendor": "Linksys",
"versions": [
{
"lessThanOrEqual": "1.01.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:linksys:wag200g:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.01.06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Messner"
}
],
"datePublic": "2013-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators\u0027 browsers when viewing the Status \u003e Wireless page."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:11.721Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "s3cur1ty Advisory m1adv2013-016: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.s3cur1ty.de/m1adv2013-016"
},
{
"name": "ExploitDB-24476: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/24476"
},
{
"name": "VulnCheck Advisory: Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-stored-xss-via-policy-name-parameter"
}
],
"title": "Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2013-20009",
"datePublished": "2026-10-28T02:03:11.721Z",
"dateReserved": "2026-10-27T21:50:43.346Z",
"dateUpdated": "2026-10-28T02:03:11.721Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2013-20008 (GCVE-0-2013-20008)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-10-28 02:03
VLAI
EPSS
VEX
Title
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
Summary
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
Severity
CWE
- CWE-620 - Unverified Password Change
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.s3cur1ty.de/m1adv2013-016 | third-party-advisory |
| https://www.exploit-db.com/exploits/24476 | exploit |
| https://www.vulncheck.com/advisories/linksys-wag2… | third-party-advisory |
Impacted products
Date Public
2013-02-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAG200G",
"vendor": "Linksys",
"versions": [
{
"lessThanOrEqual": "1.01.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:linksys:wag200g:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.01.06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Messner"
}
],
"datePublic": "2013-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:11.024Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "s3cur1ty Advisory m1adv2013-016: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.s3cur1ty.de/m1adv2013-016"
},
{
"name": "ExploitDB-24476: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/24476"
},
{
"name": "VulnCheck Advisory: Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-admin-password-change-without-current-password"
}
],
"title": "Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2013-20008",
"datePublished": "2026-10-28T02:03:11.024Z",
"dateReserved": "2026-10-27T21:50:43.346Z",
"dateUpdated": "2026-10-28T02:03:11.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2013-20007 (GCVE-0-2013-20007)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-10-28 02:03
VLAI
EPSS
VEX
Title
Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
Summary
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Severity
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.s3cur1ty.de/m1adv2013-016 | third-party-advisory |
| https://www.exploit-db.com/exploits/24476 | exploit |
| https://www.vulncheck.com/advisories/linksys-wag2… | third-party-advisory |
Impacted products
Date Public
2013-02-08 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAG200G",
"vendor": "Linksys",
"versions": [
{
"lessThanOrEqual": "1.01.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:linksys:wag200g:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.01.06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Messner"
}
],
"datePublic": "2013-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:10.353Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "s3cur1ty Advisory m1adv2013-016: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.s3cur1ty.de/m1adv2013-016"
},
{
"name": "ExploitDB-24476: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/24476"
},
{
"name": "VulnCheck Advisory: Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-os-command-injection-via-timer-interval-in-setup-cgi"
}
],
"title": "Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2013-20007",
"datePublished": "2026-10-28T02:03:10.353Z",
"dateReserved": "2026-10-27T21:50:43.346Z",
"dateUpdated": "2026-10-28T02:03:10.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2007-1585 (GCVE-0-2007-1585)
Vulnerability from cvelistv5 – Published: 2007-03-21 23:00 – Updated: 2024-08-07 12:59
VLAI
EPSS
VEX
Summary
The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
| http://www.securityfocus.com/bid/23063 | vdb-entryx_refsource_BID |
| http://secunia.com/advisories/24658 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityfocus.com/archive/1/463342/100… | mailing-listx_refsource_BUGTRAQ |
| http://marc.info/?l=bugtraq&m=117492736903388&w=2 | mailing-listx_refsource_BUGTRAQ |
Date Public
2007-03-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:59:08.805Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "linksys-udp-information-disclosure(33251)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"name": "23063",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23063"
},
{
"name": "24658",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24658"
},
{
"name": "20070320 Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"name": "20070325 Re: Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-03-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "linksys-udp-information-disclosure(33251)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"name": "23063",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23063"
},
{
"name": "24658",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24658"
},
{
"name": "20070320 Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"name": "20070325 Re: Linksys WAG200G - Information disclosure",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-1585",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "linksys-udp-information-disclosure(33251)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"name": "23063",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23063"
},
{
"name": "24658",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24658"
},
{
"name": "20070320 Linksys WAG200G - Information disclosure",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"name": "20070325 Re: Linksys WAG200G - Information disclosure",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-1585",
"datePublished": "2007-03-21T23:00:00.000Z",
"dateReserved": "2007-03-21T00:00:00.000Z",
"dateUpdated": "2024-08-07T12:59:08.805Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
VAR-200703-0627
Vulnerability from variot - Updated: 2025-04-10 23:19The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information. Linksys WAG200G is prone to a vulnerability that may disclose sensitive information. An attacker can exploit this issue to retrieve sensitive information that may aid in further attacks. This issue affects firmware version 1.01.01; other versions may also be vulnerable. Linksys WAG200G is a wireless ADSL router.
Want a new job? http://secunia.com/secunia_vacancies/
Secunia is looking for new researchers with a reversing background and experience in writing exploit code: http://secunia.com/hardcore_disassembler_and_reverse_engineer/ http://secunia.com/Disassembling_og_Reversing/ http://secunia.com/Linux_Security_Specialist/
TITLE: Linksys Products Information Disclosure Security Issue
SECUNIA ADVISORY ID: SA24658
VERIFY ADVISORY: http://secunia.com/advisories/24658/
CRITICAL: Moderately critical
IMPACT: Exposure of system information, Exposure of sensitive information
WHERE:
From local network
OPERATING SYSTEM: Linksys WAG200G http://secunia.com/product/13810/ Linksys WRT54GC http://secunia.com/product/13808/
DESCRIPTION: A security issue has been reported in various Linksys products, which can be exploited to disclose certain sensitive information. the product model, the web interface password, the PPPoA username, the PPPoA password, the SSID, and the WPA passphrase by sending a UDP packet to port 916 of the device.
The security issue is reported in WAG200G with firmware 1.01.03 and earlier, WRT54GC v1 with firmware 1.03.0 and earlier, and WRT54GC v2 with firmware 1.00.7 and earlier.
PROVIDED AND/OR DISCOVERED BY: Daniel Niggebrugge, additional information by Bartomiej Ochman
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200703-0627",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wrt54gc",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.00.7"
},
{
"model": "wag200g",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.01.01"
},
{
"model": "wrt54gc",
"scope": "lte",
"trust": 1.0,
"vendor": "linksys",
"version": "1.03.0"
},
{
"model": "wag200g",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "1.01.01"
},
{
"model": "wrt54gc",
"scope": "lte",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "1.00.7"
},
{
"model": "wrt54gc",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "1.03.0"
},
{
"model": "wrt54gc",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "1.03.0"
},
{
"model": "wrt54gc",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.01.0.7"
},
{
"model": "wag200g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.1.1"
}
],
"sources": [
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:linksys:wag200g",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:linksys:wrt54gc",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dani\u0026euml;l Niggebrugge",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
}
],
"trust": 0.6
},
"cve": "CVE-2007-1585",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2007-1585",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-24947",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-1585",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2007-1585",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200703-510",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-24947",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information. Linksys WAG200G is prone to a vulnerability that may disclose sensitive information. \nAn attacker can exploit this issue to retrieve sensitive information that may aid in further attacks. \nThis issue affects firmware version 1.01.01; other versions may also be vulnerable. Linksys WAG200G is a wireless ADSL router. \n\n----------------------------------------------------------------------\n\nWant a new job?\nhttp://secunia.com/secunia_vacancies/\n\nSecunia is looking for new researchers with a reversing background\nand experience in writing exploit code:\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\nhttp://secunia.com/Disassembling_og_Reversing/\nhttp://secunia.com/Linux_Security_Specialist/\n\n----------------------------------------------------------------------\n\nTITLE:\nLinksys Products Information Disclosure Security Issue\n\nSECUNIA ADVISORY ID:\nSA24658\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/24658/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nExposure of system information, Exposure of sensitive information\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nLinksys WAG200G\nhttp://secunia.com/product/13810/\nLinksys WRT54GC\nhttp://secunia.com/product/13808/\n\nDESCRIPTION:\nA security issue has been reported in various Linksys products, which\ncan be exploited to disclose certain sensitive information. the product model, the web interface password, the PPPoA\nusername, the PPPoA password, the SSID, and the WPA passphrase by\nsending a UDP packet to port 916 of the device. \n\nThe security issue is reported in WAG200G with firmware 1.01.03 and\nearlier, WRT54GC v1 with firmware 1.03.0 and earlier, and WRT54GC v2\nwith firmware 1.00.7 and earlier. \n\nPROVIDED AND/OR DISCOVERED BY:\nDaniel Niggebrugge, additional information by Bartomiej Ochman\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1585"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "PACKETSTORM",
"id": "55476"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-1585",
"trust": 2.5
},
{
"db": "BID",
"id": "23063",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "24658",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20070325 RE: LINKSYS WAG200G - INFORMATION DISCLOSURE",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20070320 LINKSYS WAG200G - INFORMATION DISCLOSURE",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-24947",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "55476",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "PACKETSTORM",
"id": "55476"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"id": "VAR-200703-0627",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
}
],
"trust": 0.6833333
},
"last_update_date": "2025-04-10T23:19:13.231000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Linksys",
"trust": 0.8,
"url": "http://home.cisco.com/en-apac/home"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/23063"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/24658"
},
{
"trust": 1.6,
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1585"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1585"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/463342/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://www.linksys.com/"
},
{
"trust": 0.3,
"url": "/archive/1/463342"
},
{
"trust": 0.3,
"url": "/archive/1/463834"
},
{
"trust": 0.3,
"url": "/archive/1/466176"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=117492736903388\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/disassembling_og_reversing/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/24658/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13808/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/linux_security_specialist/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "PACKETSTORM",
"id": "55476"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "PACKETSTORM",
"id": "55476"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-21T00:00:00",
"db": "VULHUB",
"id": "VHN-24947"
},
{
"date": "2007-03-20T00:00:00",
"db": "BID",
"id": "23063"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"date": "2007-04-02T02:42:23",
"db": "PACKETSTORM",
"id": "55476"
},
{
"date": "2007-03-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"date": "2007-03-21T23:19:00",
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-24947"
},
{
"date": "2007-04-19T17:11:00",
"db": "BID",
"id": "23063"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"date": "2007-04-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys WAG200G Important information such as ( Password and configuration data ) Vulnerability to be acquired",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "23063"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
}
],
"trust": 0.9
}
}