CVE-2013-10062

Public Exploit
Linksys Routers apply.cgi Path Traversal

Description

A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.

Category

6.9
CVSS
Severity: Medium
CVSS 4.0 •
EPSS 0.07%
Third-Party Advisory vulncheck.com
Affected: Linksys E1500
Published at:
Updated at:

References

Link Tags
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linksys_e1500_traversal.rb exploit
https://www.exploit-db.com/exploits/24475 exploit
https://web.archive.org/web/20150428184015/http://www.s3cur1ty.de/m1adv2013-004 technical description exploit
https://www.vulncheck.com/advisories/linksys-legacy-routers-path-traversal third party advisory

Frequently Asked Questions

What is the severity of CVE-2013-10062?
CVE-2013-10062 has been scored as a medium severity vulnerability.
How to fix CVE-2013-10062?
To fix CVE-2013-10062, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2013-10062 being actively exploited in the wild?
It is possible that CVE-2013-10062 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2013-10062?
CVE-2013-10062 affects Linksys E1500.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.