IT SBIT Services
Schneeberger
DEEN
CVE tracker

Huawei openUBMC: Hard-coded SNMPv3 USM key allows device access

CVE-2026-65198High 8.6

← All vulnerabilities

Summary

Huawei openUBMC ships a default SNMPv3 USM key that uses the same value for authentication and privacy. The key is recoverable from the open-source build and is not rotated by the Administrator password reset. An attacker with network access to the SNMP service of an affected unit can authenticate, read encrypted SNMPv3 traffic, and use SNMP access, which is mapped to full device administration including system reset and firmware upgrades.

Affected

  • Huawei openUBMC up to and including 26.06 (affected range 0 to <= 26.06 per runZero CNA record)
  • Default configuration is unaffected according to the CNA record; units that still carry the shipped key are affected

Fixed in

Unknown.

Workaround

  • Replace the default SNMPv3 USM keys so that each device uses unique keys (temporary measure named in the advisory text)
  • Disable SNMPv3 if it is not required
  • Restrict SNMP and BMC management access to a dedicated management VLAN with an allow-list

Exploitation

  • No evidence of exploitation in the wild found at the time of research
  • CISA SSVC: Automatable yes, Technical Impact partial, Exploitation none
  • Public technical details are available in the vendor-neutral advisory, which increases the risk of reproduction

Our recommendation

  • Check for Huawei openUBMC or Huawei servers with BMC/SNMPv3 in your asset inventory
  • Restrict SNMP and BMC access to trusted management networks now
  • Replace the default SNMPv3 keys with unique keys after confirming the procedure with Huawei
  • Ask Huawei for a fixed build and apply it as soon as it is available
  • Monitor SNMP and BMC logs for unexpected logins or administrative actions
  • Also check related CVE-2026-65199 and apply the same restrictions

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:28.

Original description (NVD)

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed