CVE-2026-65197

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file /conf/public.pem. That file is writable by an authenticated Redfish client through the UpdateService.UploadSignKey action, which stores the uploaded body verbatim after validating...

CVE-2026-65197 H3C G3/G5 HDM Firmware Verification Key Replacement

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file /conf/public.pem. That file is writable by an authenticated Redfish client through the UpdateService.UploadSignKey action, which stores the uploaded body verbatim after validating...

CVE-2026-65197

H3C HDM Family-A (specifically G3/G5 builds carrying the Redfish/DRE update tree, such as version 6.14.01 ) is vulnerable to a firmware verification key replacement. The UpdateService.UploadSignKey action allows an authenticated Redfish client to write to the mutable file /conf/public.pem by only...