Huawei openUBMC CVE-2026-65198

Exploitation requires that the target Huawei openUBMC/iBMC unit still carries the shipped default SNMPv3 USM key - the description confirms this key is a constant, is not rotated by the Administrator password reset, and therefore survives account provisioning, so the dangerous state is effectively the default. The attacker must know the key, which is directly recoverable from the open-source build (iBMC build key 7df2f293…, community seed 7a2f5b86…), and must have network reachability to the SNMPv3 management service with SNMPv3 enabled. The primary limiting factor is whether an operator has manually replaced/rotated the USM authentication and privacy keys away from the shipped value; units where the key was explicitly changed are not exploitable. A further weakness is that the same single value is used for both authentication and privacy, so holding it both authenticates the attacker and decrypts captured SNMPv3 traffic.

This is a genuine high-priority issue, not merely a high-CVSS paper risk. The core signals are consistent and mutually reinforcing: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity attack requiring no legitimate privileges, which matches the described mechanism - a hardcoded, non-per-unit SNMPv3 USM key that is recoverable directly from the open-source build and is not rotated by the Administrator password reset. Because the secret is a shipped constant that survives provisioning, the practical barrier to exploitation is only whether a given unit still carries the default key. The input CVSS impact metrics (C:L/I:H/A:L) appear to UNDERSTATE the real impact: the description states SNMP access maps to full device administration including system reset and firmware upgrades, which is effectively complete compromise (high confidentiality, integrity, and availability) rather than low C/A - this is noted as a disagreement with the published score, not treated as fact. On the conflicting/weaker side: there is no CISA KEV listing and no public exploit code flagged in the provided intelligence, so there is no evidence of active exploitation; EPSS and SSVC data were not supplied and cannot be used. The decisive risk amplifier is that the authentication secret is publicly derivable, so the 'PR:N' effectively means any internet- or network-adjacent attacker with the published key can act as an administrator against unpatched/unrotated units.

An attacker extracts the shipped default SNMPv3 USM key from the public openUBMC source (e.g. the iBMC build key 7df2f293… or the community seed key 7a2f5b86…), then reaches a Huawei openUBMC/iBMC management interface over the network and authenticates SNMPv3 using that key. Because SNMP access is mapped to full device administration, the attacker can decrypt management traffic and issue privileged operations such as system reset or firmware upgrade. No public exploit code was identified in the provided intelligence, but the key values are disclosed verbatim in the description/advisory, making exploitation trivial to reproduce.