H3C HDM Family-A EUVD-2026-98749

Requires an authenticated Redfish account carrying the 'firmware-update' privilege (or administrator) with network access to the BMC management interface, and an affected build - H3C HDM Family-A G3/G5 carrying the Redfish/DRE update tree (observed on G5 HDM 6.14.01); HDM2 uses a different update path and is NOT affected. The attacker overwrites the signing trust anchor by POSTing a key to UpdateService.UploadSignKey, which stores the body verbatim after validating only that the multipart filename ends in '.pem'. Exploitation is only possible because Family-A has no hardware root-of-trust (no PFR) to detect the substituted key. Limiting factors: the high privilege requirement (firmware-update/admin) and the need to then build and sign a working malicious firmware image - this is not reachable by an unauthenticated or low-privileged remote attacker.

The signals point to a LOW immediate-risk, defense-in-depth/trust-model flaw rather than an urgent remote-takeover priority. The input CVSS (3.1) reflects a high bar: AC:H, PR:H and UI:R, meaning an attacker already needs an authenticated account holding the firmware-update privilege (or administrator). No EPSS score, no KEV listing, and no POC were provided - exploitation status is therefore 'no public exploit identified at time of analysis.' The key tension is impact: the vendor-style vector rates C:L/I:L/A:N, but the described outcome - replacing the firmware trust anchor and flashing an attacker-signed malicious image onto a BMC with no hardware root-of-trust (no PFR) - is in reality a full, persistent, below-OS compromise of the management controller, which I assess as high-impact (see assessed vectors). So the CVSS base score understates technical impact while correctly capturing that the gating factor is privilege: this is primarily an abuse of trust by an already-privileged operator, defeating the firmware-signing control that is supposed to limit even privileged users. It is a real concern for high-assurance/supply-chain integrity but not a mass-exploitation priority. Data gap: EPSS/KEV/POC are simply absent from input (not confirmed negative), and no H3C vendor advisory is referenced - risk rests on a single runZero advisory.

An insider or an attacker who has already obtained a Redfish account with firmware-update privilege uploads their own public key to the BMC via the UpdateService.UploadSignKey action, which writes it verbatim to /conf/public.pem after only checking the filename ends in '.pem'. They then sign a backdoored firmware image with the matching private key and flash it; signature verification passes against the substituted key, giving them a persistent, below-OS implant on the management controller. No public exploit code was identified at time of analysis.