CVE-2026-65199
5.4MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-266
Impact
Authenticated low-privilege SNMP users can execute backend operations with full administrative privileges. An attacker needs valid low-privilege SNMP credentials and network access to the service.
Root cause
The `get_user_privilege` function in `route_mapper/account.lua` assigns the complete nine-privilege set to pseudo-identities in the `special_users` group, including the `SNMPv1_v2c` pseudo-user.
Affected systems
openUBMC; specific versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
Upgrade openUBMC once a patched release is available; as an interim mitigation, disable SNMP or restrict SNMP network access to trusted management hosts only.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account.lua`, `get_user_privilege` returns the complete nine-privilege set for a `special_users` group that includes the `SNMPv1_v2c` pseudo-user.