CVE-2026-65199: Huawei openUBMC low-privilege SNMP to administrator privilege escalation
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In routemapper/account.lua, getuserprivilege returns the complete nine-privilege set for a specialusers group that includes the SNMPv1v2c pseudo-user.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs to be an authenticated SNMP user with low privileges. No user interaction is required.
Which SNMP identities are implicated?
The affected special-users group includes the SNMPv1_v2c pseudo-user. That pseudo-identity is assigned the complete set of nine privileges.
How can I check whether an openUBMC build has the vulnerable privilege mapping?
Inspect route_mapper/account.lua and the get_user_privilege handling for the special_users group. Affected code returns the full nine-privilege set for that group, including SNMPv1_v2c.