CVE-2025-65294

Aqara Hub device firmware contains an undocumented remote access interface that does not require authentication or user interaction. Through this mechanism, an attacker can transmit and execute arbitrary system commands on the device (CWE-94 — improper control of generation of code). The attack vector is network-based, without the requirement of any privileges or physical access to the device.

An attacker can gain full control over the device, which includes confidentiality, integrity, and availability of the system — data reading, configuration modification, execution of arbitrary commands, and potential use of the device as an entry point to the local network are possible.

Patches available from the manufacturer should be applied according to the references. Until the fix is deployed, it is recommended to isolate Aqara Hub devices from public network access, for example through network segmentation or firewall restriction of access to trusted hosts only.

Aqara Camera Hub G3 firmware 4.1.9_0027, Aqara Hub M2 firmware 4.3.6_0027, Aqara Hub M3 firmware 4.3.6_0025