openUBMC CVE-2026-65199

Requires the attacker to already possess valid low-privilege SNMP access (an SNMPv1/v2c community string or SNMP user) to an openUBMC baseboard management controller whose SNMP interface is enabled and network-reachable. The specific precondition is openUBMC's privilege mapping in route_mapper/account.lua, where the SNMPv1_v2c pseudo-user belongs to the special_users group that get_user_privilege grants all nine privileges. Limiting factors: exploitation is bounded to operations actually exposed through the SNMP-to-backend route mapping, and it is not possible without at least low-privilege SNMP authentication (PR:L), so fully anonymous/unauthenticated exploitation is not supported by the available data.

This is a medium-severity privilege escalation (CWE-266, Incorrect Privilege Assignment), not a critical priority. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) indicates a network-reachable, low-complexity flaw that nonetheless REQUIRES authentication (PR:L) - an attacker must already hold low-privilege SNMP access. No EPSS probability, CISA KEV listing, or POC indicator was supplied in the input, so exploitation likelihood cannot be quantified and there is no public exploit identified at time of analysis; the absence of these signals, combined with PR:L, points away from mass/automated exploitation. One internal tension to verify: the description says the SNMP pseudo-user is granted the COMPLETE nine-privilege (administrative) set, which sounds more impactful than the vector's I:L/A:L and C:N - if mapped backend operations expose sensitive reads or destructive writes, real impact may exceed the stated 5.4, so confirm the actual scope of SNMP-mapped operations with the vendor. Overall: a legitimate authenticated-insider / credential-theft escalation risk on affected BMCs, but not a drop-everything internet-wide emergency.

An attacker holding a low-privilege SNMPv1/v2c community string (or SNMP user) on an openUBMC-managed baseboard management controller issues SNMP requests that are mapped to backend operations. Because get_user_privilege assigns the full administrative privilege set to the SNMPv1_v2c pseudo-user, those requests execute with administrator rights, letting the low-privilege caller perform actions beyond its intended role. No public proof-of-concept was identified in the provided data.