Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization manifest/build/customization/defaultpassword.lua sets AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 for the iBMC product build, and the community seed account/manufacture/defaultpassword.lua sets both to 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supplied response length without a lower-bound check. An undersized response wraps the unsigned length difference to a very large value, and the parser then reads far past the response buffer. The affected code sits in the base (non-vendor) PLDM control class and the Huawei NCSI driver, so it is reachable for any PLDM endpoint or Huawei NIC on the internal management bus, unlike the vendor-specific wangxun parser tracked separately.

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In routemapper/account.lua, getuserprivilege returns the complete nine-privilege set for a specialusers group that includes the SNMPv1v2c pseudo-user.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.

A flaw in the Linux Kernel console driver found. When setting font with malicious data by ioctl PIOFONT, kernel will write memory out of bounds. To trigger the vulnerability user need to have access to console driver like if text mode being used through a generic VGA standard display.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/releases/5.10.127/vt-drop-old-font-ioctls.patch

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Permission control vulnerability in the Gallery module. Successful exploitation of this vulnerability may affect service confidentiality

Permission verification bypass vulnerability in the Camera app. Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the Wi-Fi module. Successful exploitation of this vulnerability may affect service confidentiality.

Identity authentication bypass vulnerability in the Gallery app. Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the camera module. Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the media module. Successful exploitation of this vulnerability may affect service confidentiality.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Use After Free (UAF) vulnerability in the office service. Successful exploitation of this vulnerability may affect service confidentiality.

Buffer overflow vulnerability in the development framework module. Successful exploitation of this vulnerability may affect availability.

Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability.

Buffer overflow vulnerability in the sensor service. Successful exploitation of this vulnerability may affect availability.

Use After Free (UAF) vulnerability in the storage management module. Successful exploitation of this vulnerability may affect availability.

Data processing error vulnerability in the package management module. Successful exploitation of this vulnerability may affect availability.

Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.

Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.

Vulnerability of improper exception handling in the print module. Successful exploitation of this vulnerability may affect availability.

Buffer overflow vulnerability in the device management module. Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.