HIGH🇵🇱 Wersja polska

CVE-2025-65295

CVSS 8.1v3.1pub. 2025-12-10upd. 2025-12-17

Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Aqara Camera Hub G3

    HW
    Aqara
    all versions

  • Aqara Camera Hub G3 Firmware

    OS
    Aqara
    4.1.9_0027

  • Aqara Hub M2

    HW
    Aqara
    all versions

  • Aqara Hub M2 Firmware

    OS
    Aqara
    4.3.6_0027

  • Aqara Hub M3

    HW
    Aqara
    all versions

  • Aqara Hub M3 Firmware

    OS
    Aqara
    4.3.6_0025
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-65294CRITICAL9.8PL ✓same product

Aqara Hub — nieudokumentowany mechanizm zdalnego wykonania poleceń (RCE)

CVE-2025-65291HIGH7.4same product

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate se...

CVE-2025-65297HIGH7.5same product

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically c...

CVE-2025-65292HIGH7.3same product

Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, an...

CVE-2025-65290HIGH7.4same product

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validat...