CVE-2013-3307: exploitation status and patch state

CVE-2013-3307 · CVSS 8.3 HIGH · EPSS 53%

Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.

Is CVE-2013-3307 exploited?

• Not in the CISA KEV catalog.
• EPSS puts exploitation in the next 30 days at 53%.
• Public exploit code: proof of concept.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2013-3307

• Infected Routers Become a Hidden Scanning Fabric (2026-06-23)

Primary sources

• NVD record
• Exploit-DB 26415

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.