CVE-2013-3307

Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell…

High8.3EPSS 63.1%

Published: 11 Jul 2025
Updated: 11 Jul 2025
Reserved: 29 Apr 2013
Assigned by: mitre

Description

Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.

Scores

CVSS scores of CVE-2013-3307, by who scored it
Scored by	CVSS	Score	Vector
mitreCNA (assigner)	3.1	High8.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
NVDNVD · Deferred	3.1	High8.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS (exploitation in 30 days): 63.1% · top 0.8% of all CVEs (4 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Linksys · E1000
- affected ≤ 2.1.02
Linksys · E1200
- affected < 2.0.05
Linksys · E3200
- affected ≤ 1.0.04

References (1)

https://web.archive.org/web/20140421001918/https://www.trustwave.com/spiderlabs/advisories/TWSL2013-008.txt (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2013-3307](https://trackcve.app/badge/CVE-2013-3307.svg)](https://trackcve.app/cve/CVE-2013-3307)

Record last updated 11 Jul 2025, 19:32 UTC.