CVE-2026-65197
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file .
Published Oct 13, 2026 · updated Oct 14, 2026
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file . That file is writable by an authenticated Redfish client through the action, which stores the uploaded body verbatim after validating only that the multipart filename ends in . An administrator, or any account with privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · NIST NVD
Detected
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file . That file is writable by an authenticated Redfish client through the action, which stores the uploaded body verbatim after validating only that the multipart filename ends in . An administrator, or any account with privilege, can therefore replace the trust anchor with their own ke
Oct 14, 2026 · NIST NVD
Updated
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file . That file is writable by an authenticated Redfish client through the action, which stores the uploaded body verbatim after validating only that the multipart filename ends in . An administrator, or any account with privilege, can therefore replace the trust anchor with their own ke
Sources
- CVE.orgVulnerability recordCVE-2026-65197
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-65197
30-day exploitation probability 0.1%
first.org - NIST NVDVulnerability recordCVE-2026-65197
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file . That file is writable by an authenticated Redfish client through the action, which stores the uploaded body verbat
nvd.nist.gov