{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-65198 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-65198 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-65198 is a high-severity vulnerability in Huawei openUBMC, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-65198 and fix it if it is affected.\n\nWhat it is: CVE-2026-65198 is a high-severity vulnerability in Huawei openUBMC, published on 13 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-65198 in the wild and no public exploit code.\n\nAffected product: Huawei openUBMC. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-65198/ (Markdown: https://insights.sbomify.com/CVE-2026-65198/index.md)","id":"CVE-2026-65198","markdown":"https://insights.sbomify.com/CVE-2026-65198/index.md","name":"CVE-2026-65198","record":{"aliases":["GHSA-5754-6w67-33hx"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["privilege_escalation","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Huawei openUBMC","requires_auth":"none","summary":"Attackers can use hardcoded SNMPv3 keys to authenticate and decrypt traffic, gaining full administrative control over Huawei openUBMC devices.","user_interaction":"not_required","vuln_class":"hardcoded_credentials"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"runZero","cpe":[],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"cwes":[{"id":"CWE-321","name":"Use of Hard-coded Cryptographic Key"}],"description":"Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Huawei Default SNMPv3 USM key","id":"CVE-2026-65198","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"hardcoded_credentials","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Huawei openUBMC low-privilege SNMP to administrator privilege escalation","id":"CVE-2026-65199"},"packages":[],"prev":{"headline":"H3C G3/G5 HDM Firmware Verification Key Replacement","id":"CVE-2026-65197"},"products":["openUBMC"],"published":"2026-10-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-14","vendors":["Huawei"]},"summary":"Attackers can use hardcoded SNMPv3 keys to authenticate and decrypt traffic, gaining full administrative control over Huawei openUBMC devices.","url":"https://insights.sbomify.com/CVE-2026-65198/"}