CVE-2013-20009: Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter

Q: Who is exposed to this issue?

Linksys WAG200G devices running firmware through 1.01.06 are affected. Exploitation requires an authenticated attacker and targets an administrator who later views the Status > Wireless page.

Published Oct 28, 2026

Updated

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policyname parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.

Affected Software

1 affected component

LinkSys WAG200G<=1.01.06

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Linksys WAG200G devices running firmware through 1.01.06 are affected. Exploitation requires an authenticated attacker and targets an administrator who later views the Status > Wireless page.

What access and interaction are required for exploitation?

An attacker needs authenticated access to submit a malicious policy name through the policy_name parameter in setup.cgi, using the AccessRes.htm page. The stored script executes only when an administrator views the affected status page.

CVE-2013-20009: Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access and interaction are required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access and interaction are required for exploitation?