CVE-2026-65198

{
  "etk_id": "ETK-2026-1550",
  "cve_id": "CVE-2026-65198",
  "display_id": "CVE-2026-65198",
  "ghsa_id": "GHSA-5754-6w67-33hx",
  "euvd_id": "EUVD-2026-98750",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Hard-coded SNMPv3 credentials in openUBMC",
  "summary": "openUBMC firmware may retain shared factory SNMPv3 USM credentials. An attacker who knows the shipped secret can authenticate to affected devices, read protected SNMP traffic, and use SNMP access for administrative actions. Exposure requires that the device still use the factory SNMPv3 credentials.",
  "mitigation": "Replace the factory SNMPv3 authentication and privacy credentials on every affected device; do not rely on an administrator-password reset to change them. Until credentials are replaced, disable SNMP where it is unnecessary or restrict it to trusted management hosts and networks.",
  "vendor": "Huawei",
  "product": "openUBMC",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 26.06"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "openUBMC",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
  "epss_score": 0.0019,
  "epss_percentile": 0.0806,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 95.17130756666667,
  "t0_at": "2026-10-13T14:18:34.703000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-13T14:18:34.703000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-13T14:18:34.703000+00:00",
      "url": "https://github.com/advisories/GHSA-5754-6w67-33hx"
    }
  }
}