Huawei Default SNMPv3 USM key

Executive summary #

openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization manifest/build/customization/default_password.lua sets AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 for the iBMC product build, and the community seed account/manufacture/default_password.lua sets both to 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.

This issue is an instance of CWE-321 (Use of Hard-coded Cryptographic Key), has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (8.6, High), and current SSVC vectors of "Exploitation: PoC" and "Technical Impact: Total."

Technical details #

The SNMPv3 User-based Security Model normally derives per-user localized authentication and privacy keys from separate passphrases. openUBMC instead ships localized key material directly as a fixed hex value and assigns the same value to both roles. In manifest/build/customization/default_password.lua, deployed onto every iBMC product build, AuthenticationKey and EncryptionKey are both set to 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581. The community-build seed account/manufacture/default_password.lua assigns both to 7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b. The manufacture data binds this SNMPv3 key material to account ID 2, the default Administrator account.

To reproduce, authenticate an SNMPv3 authPriv GET as Administrator using the shipped localized key directly for both authentication and privacy. A successful response, rather than an authentication error or timeout, confirms the unit still carries the shipped key. The same key value used for the privacy key decrypts captured authPriv PDUs from that unit.

oobscan scan -p 161/udp \
  --snmp-v3-localized-key Administrator:7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581:7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581 \
  example.lan

HIGH example.lan snmp.v3.defaultCreds 161/udp username=Administrator
  password=localizedKey=7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581
  profile=huawei-usm-customization level=authPriv sysdescr="Huawei openUBMC"

Attacker value #

This issue may allow an attacker to remotely manage and compromise any device whose Administrator has not replaced the default SNMP v3 USM key.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-18: Initial findings discovered and documented
• 2026-07-21: CVE-2026-65200 reserved
• 2026-08-05: Disclosed to CISA (VU#415695)
• 2026-08-28: CISA declined to pursue coordination with a sanctioned entity
• 2026-10-13: Public disclosure