CVE-2026-65197: H3C G3/G5 HDM Firmware Verification Key Replacement
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file /conf/public.pem. That file is writable by an authenticated Redfish client through the UpdateService.UploadSignKey action, which stores the uploaded body verbatim after validating only that the multipart filename ends in .pem. An administrator, or any account with firmware-update privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.
This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.
Affected Software
Event History
Frequently Asked Questions
Which systems are in scope, and which are not?
The finding applies to H3C HDM Family-A G3/G5 builds that carry the Redfish/DRE update tree. It was observed on G5 HDM 6.14.01; HDM2 uses a different update path and is not covered.
What level of access does an attacker need?
An attacker needs an authenticated Redfish account with firmware-update privilege, or administrator access. They must upload a replacement .pem signing key, then provide a malicious firmware image signed by the corresponding private key.
Are systems protected by a hardware root of trust?
Family-A does not have PFR or another hardware root of trust described for detecting a substituted verification key. Once the mutable public key is replaced, firmware signed with the attacker's matching key can pass verification.
How can I determine whether a system may be affected?
Identify whether the device is an H3C HDM Family-A G3 or G5 system with the Redfish/DRE update tree. Review access to the Redfish UpdateService.UploadSignKey action and whether accounts beyond tightly controlled administrators have firmware-update privilege.