{"id":"CVE-2026-65198","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-65198","generatedAt":"2026-10-28T01:51:55.969Z","title":"An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key.","description":"Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.","published":"2026-10-13T15:17:47.000Z","lastModified":"2026-10-16T19:56:16.000Z","status":"Deferred","sourceIdentifier":"44488dab-36db-4358-99f9-bc116477f914","cvss":{"version":"3.1","score":8.6,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},"cwe":["CWE-321"],"affected":[],"epss":{"score":0.00189,"percentile":0.08456,"date":"2026-10-26","history":[{"date":"2026-10-14","score":0.00189,"percentile":0.07967}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.19%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-13T15:17:47.000Z","detail":{"score":"8.6","severity":"HIGH","publishedAt":"2026-10-13T15:17:46.823Z"},"summary":"New CVE, high severity (CVSS 8.6)."}],"references":[{"url":"https://www.runzero.com/advisories/huawei-default-snmpv3-usm-key-cve-2026-65198","source":"44488dab-36db-4358-99f9-bc116477f914"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-65198","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}