CVE-2026-65197

Name of the Vulnerable Software and Affected Versions H3C HDM Family-A G3/G5 (affected versions not specified)

Description The software verifies the RSA signature of a firmware image using a public key stored in the /conf/public.pem file. An authenticated Redfish client with firmware-update privileges can overwrite this file via the UpdateService.UploadSignKey action, as the system only validates that the filename ends in .pem. This allows an attacker to replace the trust anchor with a custom key and subsequently install a malicious firmware image signed with the corresponding private key. The system lacks a hardware root-of-trust, such as Platform Firmware Resilience (PFR), to detect the key substitution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.