OS Command Injection in Linksys WAG200G Router by Cisco

CVE-2013-20007

What is CVE-2013-20007?

The Linksys WAG200G router is affected by an OS command injection vulnerability that permits authenticated attackers to execute arbitrary commands. By injecting backtick-delimited input through the timer_interval parameter in a crafted POST request to setup.cgi, attackers can initiate telnetd or enable backdoor functionality. This grants them complete control over the device, posing significant security risks to networks reliant on this hardware.

References