CVE-2026-65199
Huawei openUBMC low-privilege SNMP to administrator privilege escalation
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.
| CWE | CWE-266 |
| Vendor | huawei |
| Product | openbmc |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for huawei openbmc
Be the first to know when new medium vulnerabilities affecting huawei openbmc are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
Huawei / openBMC
0 ≤ 26.06
References
Credits
HD Moore of runZero Tod Beardsley of runZero