VAR-201302-0561
Vulnerability from variot - Updated: 2025-08-06 23:24An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution. The Cisco Linksys WRT160N is a wireless router device. A directory traversal vulnerability exists in Cisco Linksys WRT160N. An attacker can send a specially crafted URL request containing a \"dot\" sequence (/.. /) in the next_page parameter to view any file on the system. A remote command-execution vulnerability 2. A directory-traversal vulnerability 3. A cross-site request-forgery vulnerability 4
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201302-0561",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linksys wrt160n build",
"scope": "eq",
"trust": 2.4,
"vendor": "cisco",
"version": "2.0.03009"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"db": "CNVD",
"id": "CNVD-2013-01016"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Michael Messner",
"sources": [
{
"db": "BID",
"id": "57887"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-354"
}
],
"trust": 0.9
},
"cve": "CVE-2013-10058",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [],
"severity": [
{
"author": "disclosure@vulncheck.com",
"id": "CVE-2013-10058",
"trust": 1.0,
"value": "High"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-10058"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An authenticated OS command injection vulnerability exists in various\u00a0Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution. The Cisco Linksys WRT160N is a wireless router device. A directory traversal vulnerability exists in Cisco Linksys WRT160N. An attacker can send a specially crafted URL request containing a \\\"dot\\\" sequence (/.. /) in the next_page parameter to view any file on the system. A remote command-execution vulnerability\n2. A directory-traversal vulnerability\n3. A cross-site request-forgery vulnerability\n4",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-10058"
},
{
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"db": "CNVD",
"id": "CNVD-2013-01016"
},
{
"db": "BID",
"id": "57887"
}
],
"trust": 3.33
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "EXPLOIT-DB",
"id": "24478",
"trust": 3.4
},
{
"db": "BID",
"id": "57887",
"trust": 3.3
},
{
"db": "EXPLOIT-DB",
"id": "25608",
"trust": 1.0
},
{
"db": "NVD",
"id": "CVE-2013-10058",
"trust": 1.0
},
{
"db": "CNVD",
"id": "CNVD-2013-01009",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2013-01014",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2013-01012",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2013-01016",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201302-354",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"db": "CNVD",
"id": "CNVD-2013-01016"
},
{
"db": "BID",
"id": "57887"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-354"
},
{
"db": "NVD",
"id": "CVE-2013-10058"
}
]
},
"id": "VAR-201302-0561",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"db": "CNVD",
"id": "CNVD-2013-01016"
}
],
"trust": 3.2333333
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 2.4
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"db": "CNVD",
"id": "CNVD-2013-01016"
}
]
},
"last_update_date": "2025-08-06T23:24:33.105000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-10058"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://www.exploit-db.com/exploits/24478/http"
},
{
"trust": 1.0,
"url": "https://web.archive.org/web/20140830181242/http://www.s3cur1ty.de/m1adv2013-012"
},
{
"trust": 1.0,
"url": "https://www.exploit-db.com/exploits/25608"
},
{
"trust": 1.0,
"url": "https://www.vulncheck.com/advisories/linksys-legacy-routers-remote-command-injection"
},
{
"trust": 1.0,
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/linksys_wrt160nv2_apply_exec.rb"
},
{
"trust": 1.0,
"url": "https://www.exploit-db.com/exploits/24478"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/57887"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"db": "CNVD",
"id": "CNVD-2013-01016"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-354"
},
{
"db": "NVD",
"id": "CVE-2013-10058"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"db": "CNVD",
"id": "CNVD-2013-01016"
},
{
"db": "BID",
"id": "57887"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-354"
},
{
"db": "NVD",
"id": "CVE-2013-10058"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01016"
},
{
"date": "2013-02-11T00:00:00",
"db": "BID",
"id": "57887"
},
{
"date": "2013-02-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201302-354"
},
{
"date": "2025-08-01T21:15:27.833000",
"db": "NVD",
"id": "CVE-2013-10058"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01009"
},
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01014"
},
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01012"
},
{
"date": "2013-02-19T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-01016"
},
{
"date": "2013-05-21T07:53:00",
"db": "BID",
"id": "57887"
},
{
"date": "2013-02-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201302-354"
},
{
"date": "2025-08-06T14:15:35.933000",
"db": "NVD",
"id": "CVE-2013-10058"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201302-354"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cisco Linksys WRT160N Multiple Security Vulnerabilities",
"sources": [
{
"db": "BID",
"id": "57887"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-354"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Input Validation Error",
"sources": [
{
"db": "BID",
"id": "57887"
}
],
"trust": 0.3
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…