Read the docs
TI-2026-71787 Aliases CVE-2026-65199GHSA-246r-j53h-wrm2

Huawei openUBMC gives low-privilege SNMP users admin rights

Priority LOW 23CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · Low · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

Huawei openUBMC versions through 26.06 are affected. The flaw is an incorrect privilege assignment (CWE-266): openUBMC gives the full set of nine privileges to pseudo-identities that represent SNMP callers. An authenticated remote attacker with low privileges can invoke mapped backend operations as an administrative identity, which affects integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Description from the CNA

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0015 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HuaweiopenBMCup to 26.06—No fix listedCNA
  • openBMC VendorHuawei Affected up to 26.06 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for openUBMC.

Written with Claude Haiku 5.5 from the sources below · 2026-10-27

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-65199
  2. 2026-10-13 Alias added: GHSA-246r-j53h-wrm2
  3. 2026-10-14 Priority changed: MEDIUM → LOW
  4. 2026-10-15 CISA SSVC decision points changed

References

Advisory 1

  • TI-2019-00485 Use after free in Microsoft Windows KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02580 Code injection in Apache Struts through Dynamic Method Invocation KEVCVSS 3.1HIGH 8.1
  • TI-2020-00067 Out-of-bounds write in Android KEVCVSS 3.1HIGH 7.8
  • TI-2019-01829 Use after free in Android KEVCVSS 3.1HIGH 7.8
  • TI-2017-10594 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a… CVSS 3.1CRITICAL 9.8
  • TI-2017-12631 Improper input validation in Huawei HG532 CVSS 3.0HIGH 8.8
See all 2424 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences