CVE-2016-3081（huawei agile controller-campus firmware）の深刻度・悪用状況・対象バージョン
8.1 重要（CVSS 3.x） 悪用確認済み（CISA KEV） EPSS 取得中…
概要
Apache Struts 2.3.19～2.3.20.2、2.3.21～2.3.24.1 および 2.3.25～2.3.28 に脆弱性があり、Dynamic Method Invocation が有効な場合、リモートの攻撃者が method: プレフィックスを使って任意のコードを実行できるおそれがあります（連鎖式に関連）。
↑ AI による日本語訳（参考）。原文:
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
実際の攻撃で悪用されています。 CISA KEV への追加日: 2026-10-08。対象製品を使っている場合は最優先で対策してください。
CISA の要求対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA の要求対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
影響を受ける製品
| ベンダー | 製品 | 対象バージョン |
|---|---|---|
| huawei | agile_controller-campus_firmware | v100r002c00 |
| huawei | anyoffice | v200r005c00 |
| huawei | anyoffice | v200r006c00 |
| huawei | logcenter | v100r001c10 |
| huawei | logcenter | v100r001c20 |
| huawei | firehunter6000_firmware | v100r001c20 |
| huawei | oceanstor_5300_v3_firmware | v300r001 |
| huawei | oceanstor_5300_v3_firmware | v300r002 |
| huawei | oceanstor_5300_v3_firmware | v300r003c00 |
| huawei | oceanstor_5300_v3_firmware | v300r003c10 |
| huawei | oceanstor_5500_v3_firmware | v300r001 |
| huawei | oceanstor_5500_v3_firmware | v300r002 |
| huawei | oceanstor_5500_v3_firmware | v300r003c00 |
| huawei | oceanstor_5500_v3_firmware | v300r003c10 |
| huawei | oceanstor_5600_v3_firmware | v300r001 |
基本情報
- 公開日
- 2016-04-26
- 最終更新
- 2026-10-09
- NVD の状態
- Analyzed
- 弱点の種類
- CWE-77
対策の進め方
- 上の表で、使っている製品とバージョンが対象か確認します。
- ベンダーの公式アドバイザリ（下の参考情報の「Vendor Advisory」「Patch」）で修正版・回避策を確認します。
- 悪用が確認されているため、パッチ適用までの間もアクセス制限・侵害の痕跡確認を検討します。
- 日本語の情報は JVN iPedia で CVE-2016-3081 を検索 できます。
参考情報
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html ExploitThird Party Advisory
- http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160527-01-struts2-en Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html PatchThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
- http://www.rapid7.com/db/modules/exploit/linux/http/struts_dmi_exec Third Party AdvisoryBroken Link
- http://www.rapid7.com/db/modules/exploit/multi/http/struts_dmi_exec Third Party Advisory
- http://www.securityfocus.com/bid/87327 Third Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/91787 Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1035665 Third Party AdvisoryVDB Entry
- https://struts.apache.org/docs/s2-032.html PatchVendor Advisory
- https://www.exploit-db.com/exploits/39756/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/136856/Apache-Struts-2.3.28-Dynamic-Method-Invocation-Remote-Code-Execution.html ExploitThird Party Advisory
- NVD: CVE-2016-3081
- CVE.org: CVE-2016-3081
データ出典: NIST NVD、CISA KEV、FIRST EPSS。翻訳は参考情報で、正確性は原文を優先してください。