High severity · published Oct 28, 2026
CVE-2013-20007
Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
New
7.2
CVSS
–
EPSS
No
On KEV
Description
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WAG200G · Linksys
through 1.01.06 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-20007
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-20007
third-party-advisory
https://www.s3cur1ty.de/m1adv2013-016
exploit
https://www.exploit-db.com/exploits/24476
third-party-advisory
https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-os-command-injection-via-timer-interval-in-setup-cgi
More from WAG200G
6.8
CVE-2013-20008
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
4.8
CVE-2013-20009
Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
–
CVE-2007-1585
The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information…