CVE-2026-65198
Received Received - Intake

Huawei iBMC Default SNMPv3 Key Authentication Bypass

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: runZero

Description
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-65198
EUVD
EUVD-2026-98750

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Huawei openUBMC 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Huawei's openUBMC firmware using a default SNMPv3 USM key that shares the same value for both authentication and privacy. The key is hardcoded in the firmware build and can be recovered from open-source code. An attacker with this key can authenticate to SNMPv3 and decrypt traffic from any affected device.

Detection Guidance

Check if SNMPv3 is enabled on Huawei devices with default USM keys. Use SNMPv3 queries with the known default keys to test authentication. Commands like snmpwalk -v 3 -u <username> -a SHA -A 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 -l authPriv -x AES -X 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 <device-ip> can verify if the device responds.

Impact Analysis

An attacker could gain full administrative access to devices using SNMPv3, including the ability to reset systems, upgrade firmware, or perform other privileged actions. Since the keys are not rotated and persist even after password resets, the risk remains until manually changed.

Mitigation Strategies

Rotate SNMPv3 USM keys on all affected Huawei devices. Disable SNMPv3 if not required. Update firmware to remove default keys. Restrict SNMP access via network segmentation and firewall rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65198. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart