← Vulnerability feed

Vulnerability record · CVE-2016-8801 · published 2 April 2017

CVE-2016-8801: Huawei oceanstor 5600 v3 firmware command injection vulnerability

Huawei · Oceanstor 5600 V3 Firmware

Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's parameters, and run this injected command with root privilege.

7.2 CVSS 3.0 High EPSS 1.2% · top 32.1% CWE-77 · Command injection
7.2CVSS 3.0 base score, v2 9.0
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's parameters, and run this injected command with root privilege.

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-storage-en Vendor Advisory
http://www.securityfocus.com/bid/94832 Third Party AdvisoryVDB Entry
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20161207-01-storage-en Vendor Advisory
http://www.securityfocus.com/bid/94832 Third Party AdvisoryVDB Entry

Track CVE-2016-8801 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2016-3081Apache Struts 2 DMI method: prefix remote code executionApache Struts 2.3.19 through 2.3.28 permits remote code execution when Dynamic Method Invocation is enabled, because the method: prefix can be abused…KEVEPSS 97%analysed7.5CVE-2016-8754Huawei oceanstor 5600 v3 firmware hard-coded credentials vulnerabilityHuawei OceanStor 5600 V3 V300R003C00 has a hardcoded SSH key vulnerability; the hardcoded keys are used to encrypt communication data and authenticat…EPSS 0.37%9.8CVE-2026-116779Freeswitch command injection vulnerabilityFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation tha…KEVEPSS 2.5%2.7CVE-2026-41709Vmware esxi vulnerabilityVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without t…KEVEPSS 0.69%10.0CVE-2026-105134Ahsay cloud backup suite command injection vulnerabilityA flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.…KEVEPSS 82%8.8CVE-2026-96951Microsoft outlook web command injection vulnerabilityImproper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a secu…KEVEPSS 9.8%9.8CVE-2026-8037Progress LoadMaster API OS Command Injection RCEProgress LoadMaster (and related ADC products) contain an OS command injection flaw in multiple API command endpoints where unsanitized input is pass…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2016-8801), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.