VYPR
← All advisories
High severity8.8NVD Advisory· Published Feb 12, 2020· Updated Jun 17, 2026

CVE-2020-8949

CVE-2020-8949

Description

Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring.

Affected products

10
  • Gocloud/Isp3000 Firmware
    cpe:2.3:o:gocloud:isp3000_firmware:4.3.0.17190:*:*:*:*:*:*:*
  • Gocloud/S2a Firmware3 versions
    cpe:2.3:o:gocloud:s2a_firmware:4.2.7.17278:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:gocloud:s2a_firmware:4.2.7.17278:*:*:*:*:*:*:*
    • cpe:2.3:o:gocloud:s2a_firmware:4.3.0.15815:*:*:*:*:*:*:*
    • cpe:2.3:o:gocloud:s2a_firmware:4.3.0.17193:*:*:*:*:*:*:*
  • Gocloud/S2a Wl Firmware
    cpe:2.3:o:gocloud:s2a_wl_firmware:4.2.7.16471:*:*:*:*:*:*:*
  • Gocloud/S3a Firmware
    cpe:2.3:o:gocloud:s3a_firmware:4.3.0.16572:*:*:*:*:*:*:*
  • Gocloud/S3a K2p Mtk Firmware
    cpe:2.3:o:gocloud:s3a_k2p_mtk_firmware:4.2.7.16528:*:*:*:*:*:*:*
  • Gocloud/Gocloud devicesdescription
  • Gocloud/S3Allm-create
    Range: K2P MTK 4.2.7.16528, 4.3.0.16572
  • Gocloud/S2A_WLllm-fuzzy
    Range: 4.2.7.17278, 4.3.0.15815, 4.3.0.17193

Patches

Vulnerability mechanics

References

1

News mentions

2