CVE-2026-65197

Executive Summary

CVE-2026-65197 is a broken code-signing trust issue in H3C HDM (Hardware Device Manager) Family-A firmware, where the firmware image's RSA signature is verified against a public key stored in the writable file /conf/public.pem. Because an authenticated Redfish client holding the firmware-update privilege can replace that trust anchor via the UpdateService.UploadSignKey action, the administrator — or any account with firmware-update privilege — can substitute the verification key and install a maliciously signed firmware image. Impact is limited by high attack complexity and required privileges (CVSS 3.1 base), but the loss of firmware integrity on a baseboard management controller is a serious platform-trust failure.

Technical Analysis

The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature). The H3C HDM Family-A firmware verifies an uploaded firmware image's RSA signature against a public key that is read from the mutable filesystem path /conf/public.pem. The design flaw is that the trust anchor is not immutable: the file can be overwritten through the Redfish UpdateService.UploadSignKey action, which accepts an uploaded body and stores it verbatim, validating only that the multipart filename ends in .pem.

This produces a straightforward key-substitution condition:

• The signing-verification public key is stored in a writable location (/conf/public.pem) rather than in immutable storage or a hardware-protected trust store.
• The write path (UpdateService.UploadSignKey) performs no cryptographic or content validation on the uploaded key material beyond filename extension checking.
• The firmware verification routine later reads /conf/public.pem as its trust anchor.

An attacker who can invoke UpdateService.UploadSignKey (requires firmware-update privilege) replaces the legitimate public key with one whose matching private key they control. They then sign a modified firmware image with that private key. When HDM verifies the image, it does so against the attacker-supplied key in /conf/public.pem, and the signature check passes.

The report notes that Family-A has no hardware root-of-trust (no PFR) to detect or block the substituted key, meaning there is no independent hardware-anchored verification to catch the manipulation. This finding was observed on H3C HDM Family-A G5 HDM 6.14.01; Family-A G3/G5 builds carrying the Redfish/DRE update tree appear affected. HDM2 uses a different update path and is not covered by this finding.

The CVSS vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) reflects a remotely reachable (network) attack requiring high complexity, high privileges, and user interaction, with limited confidentiality and integrity impact and no availability impact.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (improper signature verification via trust-anchor substitution) and the details in the NVD description. All named endpoints, paths, and parameters are taken verbatim from the description.

1. Reconnaissance / target identification: Identify reachable H3C HDM Family-A devices exposing the Redfish management interface. Determine the firmware/HDM version (observed target: HDM 6.14.01) and confirm the device is Family-A (G3/G5) carrying the Redfish/DRE update tree. HDM2 devices are not in scope.

2. Obtain/possess the required privilege: The attacker requires an authenticated account with the firmware-update privilege (or an administrator account). This is consistent with the CVSS PR:H rating.

3. Replace the trust anchor: Invoke the Redfish UpdateService.UploadSignKey action, uploading an attacker-controlled public key as the body with a multipart filename ending in .pem. Because the backend stores the uploaded body verbatim and validates only the filename extension, this overwrites the verification key material at /conf/public.pem.

4. Sign and deliver a malicious image: Using the private key matching the uploaded public key, sign a modified firmware image. Deliver the image through the normal firmware update workflow. HDM verifies the image's RSA signature against /conf/public.pem — now the attacker key — so verification succeeds despite the image being attacker-controlled.

5. Post-exploitation impact: A successfully installed, attacker-signed firmware image grants the attacker persistent control of the HDM/BMC layer. Because Family-A has no PFR/hardware root-of-trust, the substituted key cannot be caught by hardware-backed verification. The description frames this as administrative/privileged-operator abuse (an administrator or any firmware-update-privileged account), so the primary risk is a malicious or compromised privileged operator or a misuse of delegated firmware-update permissions.

No evidence of public exploitation, exploit code, or Nuclei template was provided; CISA KEV does not list this CVE.

Impact Assessment

Business impact centers on loss of firmware/chain-of-trust integrity for the H3C HDM platform layer. CVSS 3.1 base score is 3.1, with subscores: Confidentiality Low, Integrity Low, Availability None; Scope Unchanged; Attack Vector Network; Attack Complexity High; Privileges Required High; User Interaction Required.

• Confidentiality (Low): Limited exposure in the CVSS model.
• Integrity (Low): The vulnerability permits trust-anchor substitution and acceptance of attacker-signed firmware, which is an integrity violation of the update trust model.
• Availability (None): No direct availability impact is scored.

Blast radius is confined to affected H3C HDM Family-A devices (G3/G5 with the Redfish/DRE update tree; observed on HDM 6.14.01). HDM2 is not covered. The practical risk is abuse by privileged operators or accounts holding firmware-update privilege; a compromised privileged account could persist at the BMC/firmware layer. The absence of a hardware root-of-trust (PFR) on Family-A removes a hardware backstop that might otherwise detect the key substitution.

Detection Guidance

Sigma Rule

title: H3C HDM Redfish UploadSignKey Trust Anchor Replacement
id: 3f9c1b7e-6519-4a97-9c1d-h3c651970001
status: experimental
description: Detects use of the Redfish UpdateService.UploadSignKey action against H3C HDM, which can replace the firmware signature verification public key at /conf/public.pem.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-65197
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1553.006
  - cve.2026.65197
logsource:
  category: webserver
  product: h3c_hdm
detection:
  selection_action:
    cs-uri-query|contains: "UpdateService.UploadSignKey"
  selection_uri:
    cs-uri|contains: "/redfish/v1/UpdateService/Actions/"
  selection_pem:
    cs-uri-query|contains: ".pem"
  condition: selection_action or (selection_uri and selection_pem)
falsepositives:
  - Legitimate firmware signing-key rotation by authorized administrators
level: high

YARA Rule

rule CVE_2026_65197_HDM_UploadSignKey_Abuse
{
    meta:
        description = "Detects references to H3C HDM Redfish UpdateService.UploadSignKey mechanism related to CVE-2026-65197 trust-anchor substitution"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-65197"
        date = "2026-01-01"
        cve = "CVE-2026-65197"

    strings:
        $action = "UploadSignKey" ascii wide
        $svc    = "UpdateService" ascii wide
        $pem    = "/conf/public.pem" ascii wide
        $pemext = ".pem" ascii wide

    condition:
        uint16(0) == 0x5A4D or
        (($action and $svc) or ($pem) or ($action and $pemext))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65197 H3C HDM Redfish UploadSignKey trust-anchor replacement attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"UpdateService"; nocase; http.uri; content:"UploadSignKey"; nocase; http.uri; content:"/redfish/"; nocase; reference:cve,2026-65197; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-65197; classtype:attempted-admin; sid:202665197; rev:1;)

Elastic Detection

sequence by host.hostname with maxspan=15m
  [ network where http.request.method == "POST" and
      stringContains(http.request.uri.path, "/redfish/") and
      stringContains(http.request.uri.path, "UploadSignKey") ]
  [ network where http.request.method == "POST" and
      stringContains(http.request.uri.path, "/redfish/") and
      stringContains(http.request.uri.query, "UpdateService") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=redfish:api
| search uri_path="*/redfish/*" (uri_path="*UploadSignKey*" OR uri="*UpdateService.UploadSignKey*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, http_method, status
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="h3c_hdm,redfish,cve-2026-65197,">
  <rule id="100651" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri">\.redfish\/.*UploadSignKey</field>
    <description>CVE-2026-65197: H3C HDM Redfish UploadSignKey invoked - possible firmware trust-anchor replacement</description>
    <mitre>
      <id>T1553.006</id>
    </mitre>
  </rule>
  <rule id="100652" level="10">
    <decoded_as>json</decoded_as>
    <field name="uri">UpdateService</field>
    <field name="uri">\.pem</field>
    <description>CVE-2026-65197: H3C HDM update tree handling .pem upload - potential signing-key substitution</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict and review accounts holding the firmware-update privilege; this is the privilege required to invoke UpdateService.UploadSignKey. Apply least privilege and remove delegated firmware-update rights from non-essential accounts.
• Restrict network access to the Redfish management interface. Segment BMC/HDM management networks so only trusted administrative hosts can reach the Redfish endpoint, reducing the AV:N exposure.
• Audit for unexpected changes to /conf/public.pem and for unexpected firmware update activity. If the platform supports monitoring of that path, detect and alert on modifications outside approved maintenance windows.
• Treat firmware update actions as high-risk change-control events requiring out-of-band verification.

2. Patch/upgrade steps:

• No patch is available from any tracked source; Patch Sources is empty and Vendor Fix is N/A. Monitor H3C security advisories for a fixed HDM Family-A build and apply it when released.
• Where HDM2 is in use, note that it uses a different update path and is not covered by this finding.

3. Long-term hardening:

• Require the firmware verification trust anchor to reside in immutable, hardware-protected storage rather than a mutable filesystem path such as /conf/public.pem. Family-A lacks a hardware root-of-trust (no PFR); where possible migrate to platforms with hardware-anchored verification.
• Validate uploaded key material cryptographically (not solely by .pem filename extension) and require signed/authenticated key-rotation workflows.
• Enforce strong authentication and privileged access management for all Redfish administrative and firmware-update operations.

References

• NVD — CVE-2026-65197: https://nvd.nist.gov/vuln/detail/CVE-2026-65197
• CWE-347 — Improper Verification of Cryptographic Signature: https://cwe.mitre.org/data/definitions/347.html
• MITRE ATT&CK T1553.006 — Subvert Trust Controls: Code Signing: https://attack.mitre.org/techniques/T1553/006/
• H3C Security Advisories (vendor advisory portal — monitor for an HDM Family-A fix): https://www.h3c.com/en/Support/Resource_Center/Security_Advisories/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-65197 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template was identified. No threat actor campaign or exploit-in-the-wild evidence was provided; CISA KEV does not list this CVE. EPSS has not yet scored this CVE.