PT-2020-20387 · Gocloud · Gocloud S3A K2P Mtk+4

Published 2020-02-12 · Updated 2020-02-25 · CVE-2020-8949

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gocloud S2A WL version 4.2.7.16471 Gocloud S2A versions 4.2.7.17278, 4.3.0.15815, 4.3.0.17193 Gocloud S3A K2P MTK version 4.2.7.16528 Gocloud S3A version 4.3.0.16572 Gocloud ISP3000 version 4.3.0.17190

Description The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation. This can be demonstrated by the "cgi-bin/webui/admin/tools/app ping/diag ping/" substring.

Recommendations For Gocloud S2A WL version 4.2.7.16471, consider disabling the ping operation in the webui/admin/tools/app ping/diag ping/ endpoint until a patch is available. For Gocloud S2A versions 4.2.7.17278, 4.3.0.15815, 4.3.0.17193, restrict access to the vulnerable diag ping function to minimize the risk of exploitation. For Gocloud S3A K2P MTK version 4.2.7.16528, avoid using the app ping module in the affected API endpoint until the issue is resolved. For Gocloud S3A version 4.3.0.16572, consider temporarily disabling the webui/admin/tools module to prevent exploitation. For Gocloud ISP3000 version 4.3.0.17190, restrict access to the cgi-bin/webui/admin/tools/app ping/diag ping/ endpoint to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-8949

Affected Products

Gocloud Isp3000

Gocloud S2A

Gocloud S2A Wl

Gocloud S3A

Gocloud S3A K2P Mtk

References · 4

• 🔥 https://sku11army.blogspot.com/2020/02/gocloud-rce-in-gocloud-routers.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-8949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8949 · Security Note
• https://t.me/cvenotify/948 · Telegram Post