CVE-2026-65199Medium· 5.4▾ SunlitopenUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In `route_mapper/account…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-65200Low· 3.5The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transport libraries subtract a fixed header or reserved-field size from a device-supp…
CVE-2026-65198High· 8.6Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy
CVE-2016-3081High· 8.1Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2026-81645Medium· 5.9Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability.
CVE-2026-49313Medium· 5.5Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2026-81644Medium· 4.3DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability.