Vulnerability Details : CVE-2013-2678

Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script using the submit_type parameter.

Vulnerability category: Execute code

Published 2020-02-04 15:15:11

Updated 2020-02-07 14:23:12

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2013-2678

Probability of exploitation activity in the next 30 days: 93.09%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2013-2678

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	nvd@nist.gov
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	nvd@nist.gov
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2013-2678

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-2678

http://www.securityfocus.com/bid/59710

Cisco Linksys E4200 Router CVE-2013-2678 Local File Include Vulnerability
Third Party Advisory;VDB Entry
http://www.exploit-db.com/exploits/25292

Cisco Linksys E4200 - Multiple Vulnerabilities - Hardware webapps Exploit
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/121551/Cisco-Linksys-E4200-Cross-Site-Scripting-Local-File-Inclusion.html

Cisco Linksys E4200 Cross Site Scripting / Local File Inclusion ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/84072

Cisco Linksys E4200 file include CVE-2013-2678 Vulnerability Report
Third Party Advisory;VDB Entry

Products affected by CVE-2013-2678

Cisco » Linksys E4200 Firmware » Version: 1.0.05
cpe:2.3:o:cisco:linksys_e4200_firmware:1.0.05:*:*:*:*:*:*:*
Matching versions
When used together with: Cisco » Linksys E4200 » Version: N/A