CVE-2013-20008
Medium · 6.8CVSS
6.8
EPSS
0.3%
Published
Oct 28, 2026
CISA due date
—
The record
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119429 phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows… CWE-620
- CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that… CWE-620
- CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
- CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
- CVE-2026-77644 A critical bypass access control vulnerability has been reported in PTC Windchill Risk… CWE-620
- CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
- CVE-2026-17599 Nexus Repository 3 contained an endpoint used to change the administrator account… CWE-620
- CVE-2026-12692 Unverified password change vulnerability in Vimesoft Inc. CWE-620