CVE-2013-10058: Linksys Routers apply.cgi Remote Command Injection

Deferred

Published 01-08-2025Last modified 07-04-2026

Vulnerability summary

CVE-2013-10058 is a high (CVSS 8.6) OS Command Injection vulnerability in linksys wrt160nv2. EPSS estimates a 4.32% chance of exploitation in the next 30 days, higher than 91.1% of scored vulnerabilities. 5 public exploits are recorded.

Overall risk

45/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.6/10

010

High · v4.0 (CVE.org)

EPSS score

4.32%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits5exploit-database, reference, metasploit

Timeline

01-08-2025
PublishedVulnerability first disclosed.
07-04-2026
Last modifiedVulnerability information updated.

Description

An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint. The web interface fails to properly sanitize user-supplied input passed to the ping_size parameter during diagnostic operations. An attacker with valid credentials can inject arbitrary shell commands, enabling remote code execution.

CVSS metrics

2 scores · 2 sources · 1 version

v4.08.6

EPSS trend

Probability

4.32%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

No change 0.00 pp

From 4.32% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

5 found

exploit-databasehardwareUnverified
Linksys WRT160N - Multiple Vulnerabilities
Maturity: poc
exploit-databaseremotehardwareVerified
Linksys WRT160N v2 - 'apply.cgi' Remote Command Injection (Metasploit)
Maturity: weaponized
referenceUnverified
Exploit Reference (raw.githubusercontent.com)
Maturity: unknown

Show all 5 exploits

referenceUnverified
Exploit Reference (web.archive.org)
Maturity: unknown
MetasploitremoteVerified
Linksys WRT160nv2 apply.cgi Remote Command Injection
exploit/linux/http/linksys_wrt160nv2_apply_exec
Maturity: weaponized