{"id":"CVE-2026-65197","title":"H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`","summary":"H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` ac…","severity":"low","cvss":3.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-347"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T15:17:46.690","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65197","references":[{"url":"https://www.runzero.com/advisories/h3c-hdm-firmware-verification-key-replacement-cve-2026-65197","label":"44488dab-36db-4358-99f9-bc116477f914"}],"tags":["nvd"],"ingestedAt":"2026-10-13T15:33:40.079Z","slug":"CVE-2026-65197","body":"## Overview\n\nH3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. \n\nThis was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":17,"depthScoreParts":{"impact":17.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}