Linksys WAG200G: OS command injection via timer_interval in setup.cgi

Summary

The Linksys WAG200G home gateway (firmware up to and including 1.01.06) contains an OS command injection flaw in the timer_interval parameter of setup.cgi. An authenticated attacker can use a crafted POST request to inject backtick-delimited shell commands. This can start telnetd or install a backdoor, giving full control over the device. The product is end-of-life and no fixed firmware is known.

Affected

• Linksys WAG200G, firmware 0 to 1.01.06 (CVE record: <= 1.01.06)

Fixed in

Unknown. No vendor fix is known.

Workaround

• No vendor workaround available.
• Keep the web administration interface off the WAN side and disable remote management.
• Use a strong, unique admin password and limit admin access to trusted LAN hosts.

Exploitation

• Public proof of concept available (Exploit-DB 24476, public since 2013).
• Authentication required (PR:H).
• No confirmed active exploitation found in the sources.

Our recommendation

• Replace the WAG200G with a supported device; no security updates are expected.
• Until replaced, isolate the device, disable remote administration and change the admin password.
• Check for unexpected listening services and outbound connections, and monitor network traffic for anomalies.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Exploit-DB 24476 www.exploit-db.com
• s3cur1ty Advisory m1adv2013-016 www.s3cur1ty.de
• VulnCheck Advisory: Linksys WAG200G OS Command Injection www.vulncheck.com
• VulDB CVE-2013-20007 vuldb.com
• Vulners NVD:CVE-2013-20007 vulners.com
• Linksys Support: Lifecycle Policy support.linksys.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:58.