CVE-2016-8801 Command injection in OceanStor 5600 V3 V300R003C00C10 and earlier versions
Administrators can inject commands into specific parameters to execute arbitrary code with root privileges on Huawei OceanStor storage systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-8801?
CVE-2016-8801 is a high-severity command injection vulnerability in OceanStor 5600 V3 V300R003C00C10 and earlier versions, published on 2 Apr 2017. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Huawei OceanStor 5600 V3 with V300R003C00C10 and earlier versions allows attackers with administrator privilege to inject a command into a specific command's parameters, and run this injected command with root privilege.
Weakness: CWE-77
Which versions are affected by CVE-2016-8801?
It affects 1 product.
Products include Huawei Oceanstor 5600 V3 Firmware.
How do I fix CVE-2016-8801?
No fix has been published for CVE-2016-8801 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-8801 being exploited?
There is no known exploitation of CVE-2016-8801 in the wild and no public exploit code.
Other vulnerabilities in OceanStor 5600 V3 V300R003C00C10 and earlier versions
Sources
Also known as GHSA-w8hp-x9c3-2p78.