The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In routemapper/account.lua, getuserprivilege returns the complete nine-privilege set for a specialusers group that includes the SNMPv1v2c pseudo-user.

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization manifest/build/customization/defaultpassword.lua sets AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 for the iBMC product build, and the community seed account/manufacture/defaultpassword.lua sets both to 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

Huawei HG630 V2 router contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain administrative access by retrieving the device serial number. Attackers can query the /api/system/deviceinfo endpoint without authentication to extract the SerialNumber field, then use the last 8 characters as the default password to log in to the router.

Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

Boundary-unlimited vulnerability in the application read module. Impact: Successful exploitation of this vulnerability may affect availability.

Out-of-bounds write vulnerability in the file system. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the power consumption statistics module. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability.

UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

Out-of-bounds write vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

UAF vulnerability in the kernel module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

UAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability.

UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission bypass vulnerability in the LBS module. Impact: Successful exploitation of this vulnerability may affect availability.

Vulnerability of improper permission control in the theme setting module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Double free vulnerability in the multi-mode input system. Impact: Successful exploitation of this vulnerability may affect availability.

Access control vulnerability in the memo module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

Stack overflow vulnerability in the media platform. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the notification service. Impact: Successful exploitation of this vulnerability may affect availability.

Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability.

Vulnerability of improper verification in the email application. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Race condition vulnerability in the device security management module. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the permission management service. Impact: Successful exploitation of this vulnerability may affect availability.

Vulnerability of uninitialized pointer access in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability.

Buffer overflow vulnerability in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability.