Huawei Oceanstor 5600 v3 Firmware vulnerabilities

3 CVEs affecting Huawei Oceanstor 5600 v3 Firmware, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-8801, published 2017-04-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3081: Apache Struts Command Injection Vulnerability, published 2016-04-26. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 96.1% chance of exploitation in the next 30 days. Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to…
CVE-2016-8801, published 2017-04-02. High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days. Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's parameters, and run this injected command…
CVE-2016-8754, published 2017-04-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Huawei OceanStor 5600 V3 V300R003C00 has a hardcoded SSH key vulnerability; the hardcoded keys are used to encrypt communication data and authenticate different nodes of the devices. An attacker may…