CVE-2013-10062 Linksys Routers apply.cgi Path Traversal
Authenticated attackers can exploit a path traversal vulnerability in the Linksys router web interface to read arbitrary system files and configuration data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-10062?
CVE-2013-10062 is a medium-severity path traversal vulnerability in Linksys E1500, published on 1 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.
Weakness: CWE-22
Which versions are affected by CVE-2013-10062?
How do I fix CVE-2013-10062?
No fix has been published for CVE-2013-10062 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2013-10062 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-10062 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-5cpf-pp9h-vpgm.