Openubmc
Monthly
Huawei openUBMC and its related iBMC builds ship a hardcoded SNMPv3 USM key - 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 in the iBMC product build and 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b in the community seed - that is used for both authentication and privacy, so an unauthenticated attacker with network reachability to the SNMPv3 service can log in and decrypt SNMPv3 traffic once they pull the constant from the open-source build. Because SNMP is mapped to full device administration on these units, including system reset and firmware upgrade, the practical result is device-level configuration and integrity control; the key is a build constant that is not rotated by the Administrator password reset, so it survives account provisioning and the dangerous state is effectively the default. Reported severity is 8.6, but our reassessment scores it 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) given full confidentiality, integrity and availability exposure; no public exploit code was identified at time of analysis, although the key material itself is publicly recoverable from the open-source build, and the only reliable limiting factor is whether an operator has manually replaced the shipped USM keys.
Huawei openUBMC and its related iBMC builds ship a hardcoded SNMPv3 USM key - 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 in the iBMC product build and 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b in the community seed - that is used for both authentication and privacy, so an unauthenticated attacker with network reachability to the SNMPv3 service can log in and decrypt SNMPv3 traffic once they pull the constant from the open-source build. Because SNMP is mapped to full device administration on these units, including system reset and firmware upgrade, the practical result is device-level configuration and integrity control; the key is a build constant that is not rotated by the Administrator password reset, so it survives account provisioning and the dangerous state is effectively the default. Reported severity is 8.6, but our reassessment scores it 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) given full confidentiality, integrity and availability exposure; no public exploit code was identified at time of analysis, although the key material itself is publicly recoverable from the open-source build, and the only reliable limiting factor is whether an operator has manually replaced the shipped USM keys.