Medium severity · published Oct 28, 2026
CVE-2013-20009
Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
New
4.8
CVSS
–
EPSS
No
On KEV
Description
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
WAG200G · Linksys
through 1.01.06 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-20009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-20009
third-party-advisory
https://www.s3cur1ty.de/m1adv2013-016
exploit
https://www.exploit-db.com/exploits/24476
third-party-advisory
https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-stored-xss-via-policy-name-parameter
More from WAG200G
7.2
CVE-2013-20007
Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi
6.8
CVE-2013-20008
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
–
CVE-2007-1585
The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information…