# CVE-2013-20007: Linksys WAG200G OS command injection in timer_interval

Source: https://junglewise.ai/threats/cve-2013-20007-linksys-wag200g-through-1-01-06-contains-an-os-command-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2013-20007 · Severity: high · CVSS 7.2 · Published 2026-10-28

The Linksys WAG200G is a wireless ADSL home gateway router. An authenticated attacker can inject arbitrary shell commands through the timer_interval parameter in the device's web interface, allowing them to execute commands with device privileges, start telnet services, or install persistent backdoors for complete device control.

Technologies: [Linksys WAG200G](https://junglewise.ai/threats/technologies/wag200g). Vendors: [Linksys](https://junglewise.ai/threats/vendors/linksys).

## Quick answers

**Is CVE-2013-20007 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2013-20007 being exploited in the wild.

**How severe is CVE-2013-20007?** High severity, with a CVSS score of 7.2, published 28 October 2026.

**Which products and versions are affected?** Linksys WAG200G through 1.01.06.

**Is there a fix for CVE-2013-20007?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2013-20007 attacked?** It is attacked over the network.

**Am I affected by CVE-2013-20007?** Check whether you run Linksys WAG200G at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection flaw in the setup.cgi endpoint where the timer_interval parameter is not properly sanitized before being passed to a shell command. An authenticated attacker can inject backtick-delimited shell commands (e.g., `ping 192.168.1.1`) that are executed with root privileges. No patch has been released; the advisory indicates no known solution is available.

## Affected products

- Linksys WAG200G through 1.01.06

## Timeline

- 2012-10: disclosed: Vulnerability discovered
- 2012-10-16: other: Vendor contacted with details
- 2012-11-15: other: Vendor case closed
- 2013-02-08: advisory: Public advisory released

## References

- [https://www.exploit-db.com/exploits/24476](https://www.exploit-db.com/exploits/24476)
- [https://www.s3cur1ty.de/m1adv2013-016](https://www.s3cur1ty.de/m1adv2013-016)

## Related threats

- [Linksys WAG200G stored cross-site scripting in policy_name](https://junglewise.ai/threats/cve-2013-20009-linksys-wag200g-through-1-01-06-contains-a-stored-cross-site)
- [Linksys WAG200G weak password change mechanism](https://junglewise.ai/threats/cve-2013-20008-linksys-wag200g-through-1-01-06-contains-a-weak-password-change)