CVE-2013-20009

CVSS 4.8 (medium) · published 2026-10-28

Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the policy_name parameter in setup.cgi. Attackers can save a malicious policy name from the AccessRes.htm page that executes in administrators' browsers when viewing the Status > Wireless page.

Weakness: CWE-79

Source: NVD CVE-2013-20009

References

• https://www.exploit-db.com/exploits/24476
• https://www.s3cur1ty.de/m1adv2013-016
• https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-stored-xss-via-policy-name-parameter

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.