Description
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.
Published: 2026-10-13
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation to Administrator
Action: Immediate Patch
AI Analysis

Impact

openUBMC incorrectly assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated yet low‑privilege SNMP user can therefore invoke backend operations as an administrator. This flaw is a broken access control vulnerability (CWE‑266). An attacker who can use SNMP can gain full administrative rights to the system, allowing modification of configuration, installation of rogue code, or disruption of services.

Affected Systems

The flaw affects Huawei's openBMC product, specifically the openUBMC component. No specific version information is supplied in the advisory.

Risk and Exploitability

The CVSS score is 5.4, indicating a moderate severity flaw. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack requires an authenticated SNMP user with low privileges, typically reachable over the network. Based on the description, the likely attack vector is remote SNMP. If exploited, the attacker could elevate privileges to administrator and compromise the entire device.

Generated by OpenCVE AI on October 13, 2026 at 17:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest firmware or patch released by Huawei for openBMC that corrects the SNMP privilege assignment.
  • Disable SNMP v1/v2c or restrict access to SNMP v3 with robust authentication, ensuring only trusted users can interact with SNMP.
  • Review and modify the special_users group in route_mapper/account.lua to exclude the SNMPv1_v2c pseudo‑user or limit its privileges.
  • Limit SNMP access to trusted networks and secure community strings.

Generated by OpenCVE AI on October 13, 2026 at 17:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.
Title Huawei openUBMC low-privilege SNMP to administrator privilege escalation
Weaknesses CWE-266
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: runZero

Published:

Updated: 2026-10-14T18:58:40.734Z

Reserved: 2026-07-21T20:14:38.328Z

Link: CVE-2026-65199

cve-icon Vulnrichment

Updated: 2026-10-14T18:58:34.247Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T15:17:46.947

Modified: 2026-10-16T19:56:15.773

Link: CVE-2026-65199

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T17:45:17Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment