Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-65198— Huawei Default SNMPv3 USM key

Quick assessment

Affected
Huawei openUBMC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

华为 openUBMC 固件在发布时附带了一个默认的 SNMPv3 USM（用户安全模型）密钥，该密钥对身份验证和隐私加密使用相同的值。攻击者若获取该密钥（可从开源构建版本中恢复），即可向任何仍使用出厂默认密钥的设备单元进行 SNMPv3 身份验证，并解密从这些设备返回的 SNMPv3 流量。 在 iBMC 产品构建中，构建自定义文件 将认证密钥（AuthenticationKey）和加密密钥（EncryptionKey）均设置为 ；而在账户配置文件中 则将两者均设置为 。这些密钥是固定的出厂常量，并非每个设备单独

CVSS 8.6 · High

Possible ATT&CK Techniques 1 AI

T1552.004 · Private Keys

Affected Version Matrix 1

VendorProduct Version RangeStatus
Huawei openUBMC ≤ 26.06 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-65198

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Huawei Default SNMPv3 USM key
Source: CVE Program / CVE List V5
Vulnerability Description
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Huawei openUBMC 0 ~ 26.06 -

II. Public POCs for CVE-2026-65198

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-65198

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-65198 (1)

Same Patch Batch · Huawei · 2026-10-13 · 3 CVEs total

CVE-2026-65199 5.4 MEDIUM Huawei openUBMC low-privilege SNMP to administrator privilege escalation
CVE-2026-65200 3.5 LOW Huawei malicious on-bus PLDM or NCSI device can drive out-of-bounds-heap reads via short M

IV. Related Vulnerabilities

Same vendor: Huawei
Same weakness: CWE-321

V. Comments for CVE-2026-65198

No comments yet

Leave a comment