Huawei openUBMC low-privilege SNMP to administrator privilege escalation

Executive summary #

Huawei openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.

This issue is an instance of CWE-266 (Incorrect Privilege Assignment), has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L (5.4, Medium), and current SSVC vectors of "Exploitation: PoC" and "Technical Impact: Partial."

Technical details #

Backend method invocation in openUBMC is authorized against the privilege of the calling identity. The SNMP front-end represents its callers with fixed pseudo-users, and route_mapper/account.lua grants those pseudo-users the maximum privilege. In get_user_privilege, the special_users set contains <su>, SNMPv1_v2c, and redfish_user, and for any member of that set the function returns the full nine-privilege bitmask rather than a role derived from configured account rights.

local special_users = {
    ["<su>"] = true,
    ["SNMPv1_v2c"] = true,
    ["redfish_user"] = true,
}

if special_users[user_name] then
    return {
        "UserMgmt", "BasicSetting", "KVMMgmt", "VMMMgmt", "SecurityMgmt",
        "PowerMgmt", "DiagnoseMgmt", "ReadOnly", "ConfigureSelf"
    }
end

This is the authorization result the SNMP path receives after the community or USM credential is accepted. The shipped SNMP mapping tree contains more than 100 writable entries that lack a route-level Privilege field. Representative mappings include:

For bmcReboot, a SET on 1.3.6.1.4.1.<Huawei enterprise>.1.19 with ResetType=1 maps to:

{
    "Type": "Method",
    "Path": "/bmc/kepler/MacaService",
    "Interface": "bmc.kepler.SystemControl",
    "Name": "GracefulReset",
    "Params": [0]
}

Attacker value #

This issue may allow an authenticated, low-privilege SNMP user to invoke mapped backend methods with administrative privileges, without having a separate administrator account. Mapped writable operations include BMC reboot, host boot override, firmware-upgrade start from a supplied URL, local KVM state, and SNMPv3-only user-account operations. These actions can disrupt BMC or host availability and change security-relevant settings.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-18: Initial findings discovered and documented
• 2026-07-21: CVE-2026-65200 reserved
• 2026-08-05: Disclosed to CISA (VU#415695)
• 2026-08-28: CISA declined to pursue coordination with a sanctioned entity
• 2026-10-13: Public disclosure