CVE-2013-20009
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
- Score
- CVSS 4.0 4.8 Medium
- Status
- Awaiting Analysis - disclosure@vulncheck.com
- Published
- 2026-10-28
- Last modified
- 2026-10-28
- Weaknesses
- CWE-79
Affected products
References
- https://www.s3cur1ty.de/m1adv2013-016
- https://www.exploit-db.com/exploits/24476
- https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-stored-xss-via-policy-name-parameter
