CVE-2020-8949 is a high-severity flaw (CVSS 8.8) affecting s2a wl firmware, s2a firmware, s3a k2p mtk firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring.
Why this priority
High severity
Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
Published CVE record published
Updated Record last modified
gocloud s2a wl firmware MITIGATE
Affected: 4.2.7.16471
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.2.7.16471
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
gocloud s2a firmware MITIGATE
Affected: 4.2.7.17278 · 4.3.0.15815 · 4.3.0.17193
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.2.7.17278
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
gocloud s3a k2p mtk firmware MITIGATE
Affected: 4.2.7.16528
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.2.7.16528
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
gocloud s3a firmware MITIGATE
Affected: 4.3.0.16572
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.3.0.16572
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
gocloud isp3000 firmware MITIGATE
Affected: 4.3.0.17190
Fixed in: no fixed release known
Safe to downgrade to: a release before 4.3.0.17190
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-8949?
s2a wl firmware: mitigate or apply the listed mitigation; s2a firmware: mitigate or apply the listed mitigation; s3a k2p mtk firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-8949 being exploited?
CVE-2020-8949 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-8949 affect?
CVE-2020-8949 affects s2a wl firmware, s2a firmware, s3a k2p mtk firmware. Severity is high (CVSS 8.8). Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a
How urgent is CVE-2020-8949?
Priority 57/100. High severity; Public exploit reference
PatchTheCVE