CVE-2026-65198: Huawei Default SNMPv3 USM key
Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization manifest/build/customization/defaultpassword.lua sets AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 for the iBMC product build, and the community seed account/manufacture/defaultpassword.lua sets both to 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.
Affected Software
Event History
Frequently Asked Questions
Does resetting the Administrator password remove the exposure?
No. The shipped SNMPv3 USM keys are not rotated by an Administrator password reset and survive account provisioning.
What could an attacker do after authenticating with the shipped key?
SNMP access is mapped to full device administration privileges. This includes actions such as system reset and firmware upgrades, and the attacker can also decrypt SNMPv3 traffic.
Which default key applies to each build source?
The iBMC product build sets both AuthenticationKey and EncryptionKey to 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581. The community seed sets both values to 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b.
How can I determine whether a unit remains affected?
Audit its configured SNMPv3 USM authentication and privacy keys. A unit is affected if it still uses the applicable shipped constant for both values.