CVE-2013-20009 in WAG200G
Summary
by MITRE • 10/28/2026
Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Linksys WAG200G wireless gateway, specifically through firmware version 1.01.06, is susceptible to a stored cross-site scripting vulnerability within its web-based management interface. This security flaw resides in the handling of the policy_name parameter during configuration updates via the setup.cgi script. The vulnerability allows an authenticated attacker to inject malicious client-side scripts into the device's persistent storage by saving a specially crafted policy name through the AccessRes.htm page. Unlike reflected cross-site scripting attacks that require tricking a user into clicking a malicious link, this stored variant persists on the server side, ensuring that every time an administrator accesses specific sections of the management interface, the embedded script is executed automatically in their browser context.
The technical mechanism of exploitation involves manipulating the input validation routines within setup.cgi to accept and store HTML or JavaScript code as part of the policy name field. When an authenticated user navigates to the Status > Wireless page, the system retrieves this stored data for display purposes without properly sanitizing the content. Consequently, the browser interprets the injected script as legitimate code belonging to the management application's domain. This bypasses same-origin policies and allows the malicious script to interact with the Document Object Model of the administrative interface, effectively granting the attacker the ability to execute arbitrary commands within the security context of the administrator’s session.
The operational impact of this vulnerability is significant due to its stored nature and the high privilege level required for initial access. Because execution occurs when viewing the Status > Wireless page, any administrator who accesses this routine after a malicious policy has been saved will trigger the payload. This can lead to complete compromise of the administrative account, including session hijacking where an attacker steals cookies or authentication tokens to impersonate the admin without needing credentials again. Furthermore, the script can perform actions on behalf of the user, such as modifying network configurations, redirecting traffic through a malicious proxy for man-in-the-middle attacks, or exfiltrating sensitive configuration data and logs from the device. The persistence of the payload means that even if the initial attacker is logged out, subsequent administrative visits will continue to execute the attack until the malicious policy is manually removed by an administrator who may already be compromised.
This vulnerability aligns with CWE-80, which describes Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), specifically highlighting the failure to sanitize user input before storing it for later retrieval and display. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1189 Drive-by Client-Side Code Execution via Stored Content, where malicious code is embedded into legitimate content to be executed by victims accessing that content. It also relates to T1078 Valid Accounts, as the attack requires prior authentication, and potentially T1534 Internal Spearphishing if used in conjunction with social engineering to lure an admin to a specific page after initial compromise via other means.
Mitigation strategies for this vulnerability primarily involve upgrading to firmware versions that have patched the input validation logic in setup.cgi. Administrators should ensure that all special characters and script tags are properly escaped or encoded before being stored by the backend system. If immediate patching is not possible, network-level controls such as Web Application Firewalls can be configured to detect and block requests containing suspicious patterns in the policy_name parameter during POST operations to setup.cgi. Additionally, implementing strict Content Security Policy headers on the management interface can help mitigate the impact of any successfully injected scripts by restricting the sources from which executable code can be loaded or executed. Regular auditing of configuration entries for anomalous content is also recommended to detect and remove stored payloads before they are triggered during routine administrative tasks.