PT-2025-31696 · Linksys · Linksys Routers

Published 2012-10-21 · Updated 2025-08-01 · CVE-2013-10062

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Linksys router versions 1.0.00, 1.0.04, and 1.0.05

Description A directory traversal vulnerability exists in the web interface, specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences, potentially exposing sensitive system files and configuration data.

Recommendations Linksys router version 1.0.00: Update to a newer firmware version. Linksys router version 1.0.04: Update to a newer firmware version. Linksys router version 1.0.05: Update to a newer firmware version.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-11351

CVE-2013-10062

Affected Products

Linksys Routers

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2013-10062 · Security Note
• https://bdu.fstec.ru/vul/2025-11351 · Security Note
• https://t.me/CVEtracker/28983 · Telegram Post
• https://vuldb.com/sv/?id.318570 · Note
• https://vulncheck.com/advisories/linksys-legacy-routers-path-traversal · Note
• https://exploit-db.com/exploits/24475 · Note
• https://web.archive.org/web/20150428184015/http://s3cur1ty.de/m1adv2013-004 · Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linksys_e1500_traversal.rb · Note