H3C HDM Family-A up to 6.14.01 Firmware Image Verification /conf/public.pem UpdateService.UploadSignKey data authenticity

Summaryinfo

A vulnerability categorized as very critical has been discovered in H3C HDM Family-A up to 6.14.01. This impacts the function UpdateService.UploadSignKey of the file /conf/public.pem of the component Firmware Image Verification. Executing a manipulation can lead to data authenticity. This vulnerability is tracked as CVE-2026-65197. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in H3C HDM Family-A up to 6.14.01 and classified as very critical. This vulnerability affects the function UpdateService.UploadSignKey of the file /conf/public.pem of the component Firmware Image Verification. The manipulation with an unknown input leads to a data authenticity vulnerability. The CWE definition for the vulnerability is CWE-345. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by an authenticated Redfish client through the `UpdateService.UploadSignKey` action, which stores the uploaded body verbatim after validating only that the multipart filename ends in `.pem`. An administrator, or any account with `firmware-update` privilege, can therefore replace the trust anchor with their own key, sign a malicious image with the matching private key, and have it pass verification. Family-A has no hardware root-of-trust (no PFR) to catch the substituted key.  This was observed on H3C HDM Family-A G5 HDM 6.14.01. H3C HDM Family-A G3/G5 builds carrying the Redfish/DRE update tree appear to be affected. HDM2 uses a different update path and is not covered by this finding.

The advisory is shared for download at runzero.com. This vulnerability was named CVE-2026-65197 since 07/21/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/13/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• H3C

Name

• HDM Family-A

Version

• 6.14.01

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion