CVE-2026-65198

Published: Ott 13, 2026 Last Modified: Ott 13, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,6
Source: 44488dab-36db-4358-99f9-bc116477f914
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: low
Integrity: high
Availability: low

Description

AI Translation Available

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

321

Use of Hard-coded Cryptographic Key

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism Gain Privileges Or Assume Identity Read Application Data
Applicable Platforms
Technologies: ICS/OT
Likelihood of Exploit: High
View CWE Details
https://www.runzero.com/advisories/huawei-default-snmpv3-us…
https://www.runzero.com/advisories/huawei-default-snmpv3-usm-key-cve-2026-65198