Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.1

H3C HDM G5 firmware can be signed with attacker key

CVE-2026-65197 · published 5 days ago
Summary

The H3C HDM Family-A G5 device stores a public key in a file that can be changed by anyone with firmware‑update rights. By replacing this key, an attacker can sign a malicious firmware image and the device will accept it as legitimate. Update the device to a version that protects the key file or restrict who can use the firmware‑update privilege.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
h3c hdm family-a g5 <= 6.14.01
Original advisory text
H3C G3/G5 HDM Firmware Verification Key Replacement
H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key. 

This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published13 Oct 2026
Updated16 Oct 2026
First seen13 Oct 2026
Sources
CVE-2026-65197 · NVD
CVE-2026-65197 · MITRE
Track software like this
Free during beta