{"id":"CVE-2026-65197","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-65197","generatedAt":"2026-10-28T01:40:11.440Z","title":"An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification.","description":"H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. \n\nThis was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.","published":"2026-10-13T15:17:47.000Z","lastModified":"2026-10-16T19:56:16.000Z","status":"Deferred","sourceIdentifier":"44488dab-36db-4358-99f9-bc116477f914","cvss":{"version":"3.1","score":3.1,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N"},"cwe":["CWE-347"],"affected":[],"epss":{"score":0.00098,"percentile":0.00767,"date":"2026-10-26","history":[{"date":"2026-10-14","score":0.00098,"percentile":0.00739}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-13T15:17:47.000Z","detail":{"score":"3.1","severity":"LOW","publishedAt":"2026-10-13T15:17:46.690Z"},"summary":"New CVE, low severity (CVSS 3.1)."}],"references":[{"url":"https://www.runzero.com/advisories/h3c-hdm-firmware-verification-key-replacement-cve-2026-65197","source":"44488dab-36db-4358-99f9-bc116477f914"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-65197","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}