CVE-2026-65197 Details
Description
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.
A vulnerability exists in the H3C HDM Family-A G3 and G5 models, specifically in the firmware version 6.14.01. The issue arises because the firmware verifies RSA signatures of updates using a public key stored in a mutable file, '/conf/public.pem'. This file can be overwritten by an authenticated Redfish client via the 'UpdateService.UploadSignKey' action, which only checks that the uploaded file name ends with '.pem'. An administrator or any user with 'firmware-update' privileges can replace the original key with a malicious one, sign a harmful firmware image, and have it accepted during the update process. This vulnerability is exacerbated by the absence of a hardware root-of-trust in Family-A, allowing the substitution to go undetected.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 14, 2026CNA
Assessed Jan 1, 1References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.runzero.com/advisories/h3c-hdm-firmware-verification-key-replacement-cve-2026-65197 | runZero | AdvisoryTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | runZero |
Affected Products
| Product | Versions |
|---|---|
| H3C HDM Family-A G3 | All versions |
CPE
Remediation
| |
| H3C HDM Family-A G5 | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | runZero |