SNMPv3 Vulnerability in Huawei's openUBMC Product

CVE-2026-65198

What is CVE-2026-65198?

Huawei's openUBMC product contains a security flaw where a default SNMPv3 User Security Model (USM) key is utilized for both authentication and encryption. As a result, an attacker who obtains this key – which can be sourced from the open-source build – is able to authenticate and decrypt SNMPv3 traffic to any affected unit still using the pre-configured key. This configuration is particularly dangerous as it grants full administrative privileges over the device, potentially allowing unauthorized system resets and firmware upgrades. The static keys, established through default build scripts, do not change despite administrator password resets, which means they can persist through multiple account provisioning cycles, increasing the risk of exploitation.

References