CVE-2013-2684

MEDIUM

Cisco Linksys E4200 1.0.05 Build 7 - Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2013-2684. PoCs published by sqlhacker.

AI-analyzed exploit summary The exploit demonstrates reflected XSS and LFI vulnerabilities in Cisco Linksys E4200 firmware. It includes PoC examples for both XSS (via multiple parameters) and LFI (via path traversal in `apply.cgi`).

Description

Cross-site Scripting (XSS) in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploits (1)

exploitdb WORKING POC
by sqlhacker · textwebappshardware
https://www.exploit-db.com/exploits/25292

The exploit demonstrates reflected XSS and LFI vulnerabilities in Cisco Linksys E4200 firmware. It includes PoC examples for both XSS (via multiple parameters) and LFI (via path traversal in `apply.cgi`).

Classification
Working Poc 90%
Attack Type
Xss | Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Cisco Linksys E4200 Firmware Version 1.0.05 build 7 and prior
No auth needed
Prerequisites: Network access to the vulnerable device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/59716
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/84070

Scores

CVSS v3 6.1
EPSS 0.0371
EPSS Percentile 88.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
cisco/linksys_e4200_firmware 1.0.05
Published Feb 06, 2020
Tracked Since Feb 18, 2026