CVE-2026-65197
Received Received - Intake

Authentication Bypass via RSA Key Replacement in H3C HDM Family-A

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: runZero

Description
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.  This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-65197
EUVD
EUVD-2026-98749

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
H3C HDM Family-A G5 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an authenticated user with firmware-update privilege to replace the RSA public key used to verify firmware images. The attacker uploads a malicious key via the UpdateService.UploadSignKey action, signs a malicious firmware image with a matching private key, and bypasses signature verification. The system lacks a hardware root-of-trust to detect the key substitution.

Detection Guidance

Check for unauthorized modifications to the `/conf/public.pem` file on H3C HDM Family-A systems. Verify file permissions and ownership to ensure only authorized processes can write to it. Monitor Redfish `UpdateService.UploadSignKey` actions for unexpected key uploads.

Impact Analysis

An attacker could gain unauthorized access or control by installing malicious firmware. This could lead to data breaches, system compromise, or denial of service. Only users with firmware-update privileges or administrative access can exploit this vulnerability.

Mitigation Strategies

Restrict write access to `/conf/public.pem` to only trusted administrators. Disable the `UpdateService.UploadSignKey` action if not required. Monitor firmware update logs for suspicious activity. Consider isolating affected systems until patches are applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart