Stored Cross-Site Scripting in Linksys WAG200G by Cisco

CVE-2013-20009

What is CVE-2013-20009?

The Linksys WAG200G router, up to version 1.01.06, is susceptible to a stored cross-site scripting (XSS) vulnerability. This issue arises from improper input validation in the 'policy_name' parameter of the setup.cgi script. Authenticated attackers can exploit this vulnerability by injecting malicious scripts that are then saved as policy names via the AccessRes.htm page. When administrators access the Status > Wireless page, these scripts execute in their browsers, potentially allowing attackers to steal sensitive information or perform unauthorized actions.

References