# CVE-2020-8949

> As of 2024-08-04, CVE-2020-8949 is a vulnerability, EPSS 2.8% (86.3th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2020-8949, most recently “Botnet Scanning Internet-Exposed Router Diagnostic Tools Exploiting OS Command Injection (CVE-2024-12856, CVE-2013-7179, CVE-2020-8949, CVE-2024-48419)”.

**Last updated:** 2024-08-04

## What is CVE-2020-8949?

Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring.

The identifier was first published 2432 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 2.8% probability of exploitation in the next 30 days, higher than 86.3% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 5.5/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2020-02-12, last modified 2024-08-04

## Is CVE-2020-8949 being exploited?

Weaponised exploit code for CVE-2020-8949 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 35 in the Threadlinqs vulnerability feed.

- [trickest/cve](https://github.com/trickest/cve/blob/main/2020/CVE-2020-8949.md) (trickest)

## Affected products and versions

No affected-product or package list has been recorded for CVE-2020-8949 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

## How to fix CVE-2020-8949

No vendor patch reference has been recorded for CVE-2020-8949 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2020-8949

1 tracked threat in the Threadlinqs corpus references CVE-2020-8949, either in the campaign’s CVE list or as an indicator on the campaign record.

- [Botnet Scanning Internet-Exposed Router Diagnostic Tools Exploiting OS Command Injection (CVE-2024-12856, CVE-2013-7179, CVE-2020-8949, CVE-2024-48419)](https://intel.threadlinqs.com/threat/TL-2026-1884) — HIGH · 2026-08-05

## Sources

Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

**Other references**

- [sku11army.blogspot.com](https://sku11army.blogspot.com/2020/02/gocloud-rce-in-gocloud-routers.html)

Canonical: https://intel.threadlinqs.com/cve/CVE-2020-8949
Full detection coverage and IOCs for threats exploiting CVE-2020-8949 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp