CVE-2013-20007 in WAG200G
Summary
by MITRE • 10/28/2026
Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Linksys WAG200G wireless gateway series, specifically firmware versions up through 1.01.06, suffers from a critical OS command injection vulnerability that fundamentally compromises the integrity of the administrative interface. This flaw resides within the handling of the timer_interval parameter during configuration updates submitted via POST requests to the setup.cgi script. The underlying technical defect stems from insufficient input validation and sanitization mechanisms on the server side. When an authenticated user submits data for this specific field, the application fails to properly escape or filter special shell characters, particularly backticks which are interpreted as command substitution delimiters in Unix-like operating systems. This lack of rigorous boundary checking allows malicious payloads embedded within the parameter value to be executed directly by the underlying system shell rather than being treated as simple configuration data.
The operational impact of this vulnerability is severe due to its potential for remote code execution with elevated privileges. Although the exploit requires authentication, many consumer-grade routers like the WAG200G often ship with default credentials or allow users to maintain weak passwords, effectively making the attack surface accessible to external adversaries who can perform brute-force attacks or leverage leaked credential databases. Once authenticated and able to inject commands via backticks, an attacker can execute arbitrary system commands on the device. This capability enables the initiation of services such as telnetd, which opens a remote shell interface for persistent access. Furthermore, attackers can utilize this execution vector to download and run malicious binaries or backdoors from external servers, thereby gaining full control over the compromised hardware.
From a threat intelligence perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attack pattern corresponds directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging shell commands for lateral movement or persistence. By establishing a foothold through telnetd or backdoor installation, the attacker can pivot from initial access to more advanced stages of intrusion such as credential harvesting, network reconnaissance, and potentially using the compromised router as a botnet node or proxy for further attacks against internal network assets. The ability to execute commands with root-level privileges amplifies the risk significantly, allowing complete manipulation of firewall rules, DNS settings, and connected devices on the local network segment.
Mitigation strategies must prioritize immediate firmware updates if available from Linksys, ensuring that all instances are patched beyond version 1.01.06 where input validation is strengthened. In environments where patching is not immediately feasible, administrators should enforce strong, complex passwords for administrative accounts to mitigate brute-force risks and disable remote management features whenever possible to reduce the attack surface exposed to external networks. Network segmentation can also help contain potential damage by isolating IoT devices from critical internal infrastructure. Additionally, deploying intrusion detection systems that monitor for anomalous POST requests containing shell metacharacters in configuration parameters may provide early warning of exploitation attempts before full compromise occurs.