CVE-2025-65294

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.

The risk includes full device takeover by a remote attacker, potentially leading to privacy breaches, espionage, or use of the device as an entry point into the network.

Check for firmware updates from the vendor and apply them immediately, and restrict external access to the devices.