CVE-2013-20009
Received Received - Intake

Stored XSS in Linksys WAG200G via policy_name Parameter

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2013-20009
EUVD
EUVD-2013-7303

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Linksys WAG200G 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Linksys WAG200G firmware versions up to 1.01.06. An authenticated attacker can inject malicious scripts via the policy_name parameter in setup.cgi. The injected script is stored and later executed in the browsers of administrators when they view the Status > Wireless page.

Detection Guidance

To detect this vulnerability, inspect the Linksys WAG200G device for unauthorized policy names containing scripts. Check the AccessRes.htm page for malicious entries in the policy_name parameter. Review the Status > Wireless page for unexpected script execution in the browser.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of the admin, or redirect the admin to malicious sites. This could lead to unauthorized access to the router's settings or network, compromising confidentiality and integrity of data.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face fines or penalties if such breaches occur due to inadequate security measures.

Mitigation Strategies

Immediately update the Linksys WAG200G firmware to the latest version if available. Remove any suspicious policy names from the AccessRes.htm page. Restrict administrative access to trusted users only and monitor network traffic for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2013-20009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart