CVE Intelligence
Skip to main content
LOW

CVE-2026-65197

CVE-2026-65197 — H3C G3/G5 HDM Firmware Verification Key Replacement

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.

Published Updated Sources: cvelistV5, runZero

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

Not scored

FIRST has not published a score

Affects

h3c

hdm_family_a_g5

CVSS base

3.1

LOW

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (1)

h3c

Products (1)

hdm family a g5

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
3.1CVSS 3.1LOW——cvelistV5

Weakness & attack patterns

  • CWE-347

Detection

Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.

  • Search application, proxy, and WAF logs for requests touching /conf/public.pem, /G5, /DRE.

References

1 on the record

Elsewhere on this site

  • h3cevery CVE for this vendor
  • CWE-347other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.