Common Weakness Enumeration
CWE-620
AllowedUnverified Password Change
Abstraction: Base · Status: Draft
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
101 vulnerabilities reference this CWE, most recent first.
CVE-2013-20008 (GCVE-0-2013-20008)
Vulnerability from cvelistv5 – Published: 2026-10-28 02:03 – Updated: 2026-11-02 19:50
VLAI
EPSS
VEX
Title
Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password
Summary
Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:50 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
VulnCheck
CNA
References
3 references
| URL | Tags |
|---|---|
| https://www.s3cur1ty.de/m1adv2013-016 | third-party-advisory |
| https://www.exploit-db.com/exploits/24476 | exploit |
| https://www.vulncheck.com/advisories/linksys-wag2… | third-party-advisory |
Impacted products
Date Public
2013-02-08 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2013-20008",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:50:07.009822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:50:18.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WAG200G",
"vendor": "Linksys",
"versions": [
{
"lessThanOrEqual": "1.01.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:linksys:wag200g:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.01.06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Michael Messner"
}
],
"datePublic": "2013-02-08T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without supplying the current password. Attackers with access to an authenticated administrator browser session can set a new password to lock out the legitimate administrator and take persistent device control."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T02:03:11.024Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "s3cur1ty Advisory m1adv2013-016: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"third-party-advisory"
],
"url": "https://www.s3cur1ty.de/m1adv2013-016"
},
{
"name": "ExploitDB-24476: Linksys WAG200G Multiple Vulnerabilities",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/24476"
},
{
"name": "VulnCheck Advisory: Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/linksys-wag200g-through-1.01.06-admin-password-change-without-current-password"
}
],
"title": "Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2013-20008",
"datePublished": "2026-10-28T02:03:11.024Z",
"dateReserved": "2026-10-27T21:50:43.346Z",
"dateUpdated": "2026-11-02T19:50:18.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
When prompting for a password change, force the user to provide the original password in addition to the new password.
Mitigation
Architecture and Design
Do not use "forgotten password" functionality. But if you must, ensure that you are only providing information to the actual user, e.g. by using an email address or challenge question that the legitimate user already provided in the past; do not allow the current user to change this identity information until the correct password has been provided.
No CAPEC attack patterns related to this CWE.