PT-2025-31692 · Linksys · Wrt160Nv2+1

Published 2012-12-23 · Updated 2025-08-01 · CVE-2013-10058

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Linksys router versions v2.0.03

Description An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2). The web interface does not properly sanitize user-supplied input passed to the ping size parameter of the /apply.cgi API endpoint during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.

Recommendations Update to a newer firmware version to address this issue.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-11370

CVE-2013-10058

Affected Products

Linksys Routers

Wrt160Nv2

References · 10

• https://bdu.fstec.ru/vul/2025-11370 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-10058 · Security Note
• https://web.archive.org/web/20140830181242/http://s3cur1ty.de/m1adv2013-012 · Note
• https://exploit-db.com/exploits/25608 · Note
• https://vulncheck.com/advisories/linksys-legacy-routers-remote-command-injection · Note
• https://vuldb.com/?product.linksys:wrt160n · Note
• https://vuldb.com/?id.7696 · Note
• https://t.me/CVEtracker/28979 · Telegram Post
• https://exploit-db.com/exploits/24478 · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/linksys_wrt160nv2_apply_exec.rb · Note