H3C HDM Firmware Verification Key Swap Vulnerability (CVE-2026-65197) Analysis

Vulnerability Overview The H3C HDM Family-A Firmware Verification Key Substitution Vulnerability (CVE-2026-65197) allows an attacker to bypass firmware signature verification by substituting the firmware verification key, thereby enabling the upload and execution of malicious firmware. This vulnerability has a CVSS v3.1 score of 6.7 (Medium). The current SSVC vector indicates “Exploit: PoC” and “Technical Impact: Total.” Scope Vendor: H3C Products: H3C HDM Family-A G3, H3C HDM Family-A G5 Related CVE: CVE-2026-65197 Remediation No specific remediation steps are currently provided on the page. It is recommended that users monitor for official updates or patches released by the vendor. Proof of Concept (PoC) Technical Details 1. Firmware Verification Process: - The firmware verification routine first attempts to access . If it does not exist, it checks , and finally falls back to . - If exists, it is used for signature verification. 2. Key Substitution Method: - Through the operation, an attacker can upload a public key file in PEM format, which is written to . - This operation only validates that the filename ends with ; it does not validate the PEM content itself. Therefore, an attacker can upload any arbitrary PEM file. 3. Exploitation Steps: - Upload the substituted public key file to . - Sign the malicious firmware image using the new key. - Submit the malicious firmware image through the normal update process. Attacker Value Users possessing privileges (typically administrators) can install persistent firmware implants or downgrade to a previously vulnerable version. The installed image becomes the running BMC firmware, exposing platform management functions to the host. This vulnerability is particularly useful for attackers seeking to obtain privileges through other means. Timeline 2026-07-18: Initial discovery and documentation 2026-07-21: CVE-2026-65197 reserved 2026-08-05: Reported to CISA (VU#415695) 2026-08-28: CISA opened case VU#759570 2026-10-13: Public disclosure Author Information Author: Tod Beardsley Position: VP of Security Research at runZero Background: Former Head of VRC at CISA’s Cybersecurity and Infrastructure Security Agency, Austin City Election Judge, with extensive experience in vulnerability research and coordinated vulnerability disclosure (CVD). Subscription Subscribe: Receive the latest news and expert insights directly to your inbox. --- The above summarizes the key information regarding the vulnerability from the page.

Goal Reached Thanks to every supporter — we hit 100%!

H3C HDM Firmware Verification Key Swap Vulnerability (CVE-2026-65197) Analysis