Hdm Family A G5
Monthly
H3C HDM Family-A G3/G5 BMCs allow an authenticated Redfish account with the 'firmware-update' privilege (or administrator) to replace the RSA trust anchor used for firmware signature verification, enabling a malicious firmware image to pass validation. This affects builds carrying the Redfish/DRE update tree, observed on G5 HDM 6.14.01, while HDM2 uses a different update path and is not affected; no public exploit has been identified at time of analysis. The independent assessment rates this as a low immediate-risk, defense-in-depth trust-model flaw given the high privilege requirement and the need to craft a signed malicious image, though successful exploitation would yield high confidentiality, integrity, and availability impact.
H3C HDM Family-A G3/G5 BMCs allow an authenticated Redfish account with the 'firmware-update' privilege (or administrator) to replace the RSA trust anchor used for firmware signature verification, enabling a malicious firmware image to pass validation. This affects builds carrying the Redfish/DRE update tree, observed on G5 HDM 6.14.01, while HDM2 uses a different update path and is not affected; no public exploit has been identified at time of analysis. The independent assessment rates this as a low immediate-risk, defense-in-depth trust-model flaw given the high privilege requirement and the need to craft a signed malicious image, though successful exploitation would yield high confidentiality, integrity, and availability impact.