Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi

Summary

Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to execute commands by injecting backtick-delimited input into the timer_interval parameter. Attackers can send a crafted POST request to setup.cgi to start telnetd or download and run a backdoor, gaining full device control.

Remediation

1. Inventory every Linksys WAG200G deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://www.s3cur1ty.de/m1adv2013-016
• Advisoryhttps://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-os-command-injection-via-timer-interval-in-setup-cgi
• Referencehttps://www.exploit-db.com/exploits/24476