Read the docs
TI-2020-07183 Aliases CVE-2020-8949GHSA-fr6x-3vx5-3qj2

Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P…

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring.

Why it matters now

EPSS 0.02853 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:gocloud:s2a_wl_firmware:4.2.7.16471:*:*:*:*:*:*:*4.2.7.16471VulnerableGocloud
cpe:2.3:h:gocloud:s2a_wl:-:*:*:*:*:*:*:*not specified by NVDRunning onGocloud
cpe:2.3:o:gocloud:s2a_firmware:4.2.7.17278:*:*:*:*:*:*:*4.2.7.17278VulnerableGocloud
cpe:2.3:o:gocloud:s2a_firmware:4.3.0.15815:*:*:*:*:*:*:*4.3.0.15815VulnerableGocloud
cpe:2.3:o:gocloud:s2a_firmware:4.3.0.17193:*:*:*:*:*:*:*4.3.0.17193VulnerableGocloud
cpe:2.3:h:gocloud:s2a:-:*:*:*:*:*:*:*not specified by NVDRunning onGocloud
cpe:2.3:o:gocloud:s3a_k2p_mtk_firmware:4.2.7.16528:*:*:*:*:*:*:*4.2.7.16528VulnerableGocloud
cpe:2.3:h:gocloud:s3a_k2p_mtk:-:*:*:*:*:*:*:*not specified by NVDRunning onGocloud
cpe:2.3:o:gocloud:s3a_firmware:4.3.0.16572:*:*:*:*:*:*:*4.3.0.16572VulnerableGocloud
cpe:2.3:h:gocloud:s3a:-:*:*:*:*:*:*:*not specified by NVDRunning onGocloud
  • cpe:2.3:o:gocloud:s2a_wl_firmware:4.2.7.16471:*:*:*:*:*:*:* Versions 4.2.7.16471 Vulnerable ·Gocloud
  • cpe:2.3:h:gocloud:s2a_wl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gocloud
  • cpe:2.3:o:gocloud:s2a_firmware:4.2.7.17278:*:*:*:*:*:*:* Versions 4.2.7.17278 Vulnerable ·Gocloud
  • cpe:2.3:o:gocloud:s2a_firmware:4.3.0.15815:*:*:*:*:*:*:* Versions 4.3.0.15815 Vulnerable ·Gocloud
  • cpe:2.3:o:gocloud:s2a_firmware:4.3.0.17193:*:*:*:*:*:*:* Versions 4.3.0.17193 Vulnerable ·Gocloud
  • cpe:2.3:h:gocloud:s2a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gocloud
  • cpe:2.3:o:gocloud:s3a_k2p_mtk_firmware:4.2.7.16528:*:*:*:*:*:*:* Versions 4.2.7.16528 Vulnerable ·Gocloud
  • cpe:2.3:h:gocloud:s3a_k2p_mtk:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gocloud
  • cpe:2.3:o:gocloud:s3a_firmware:4.3.0.16572:*:*:*:*:*:*:* Versions 4.3.0.16572 Vulnerable ·Gocloud
  • cpe:2.3:h:gocloud:s3a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gocloud
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:gocloud:isp3000_firmware:4.3.0.17190:*:*:*:*:*:*:*4.3.0.17190VulnerableGocloud
cpe:2.3:h:gocloud:isp3000:-:*:*:*:*:*:*:*not specified by NVDRunning onGocloud
  • cpe:2.3:o:gocloud:isp3000_firmware:4.3.0.17190:*:*:*:*:*:*:* Versions 4.3.0.17190 Vulnerable ·Gocloud
  • cpe:2.3:h:gocloud:isp3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Gocloud

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8949
  2. 2026-10-03 Alias added: GHSA-fr6x-3vx5-3qj2

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences