CVE-2025-65295
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Multiple vulnerabilities in the firmware update process of Aqara Hub devices (Camera Hub G3, Hub M2, Hub M3) allow attackers to install malicious firmware without proper verification. The devices fail to validate firmware signatures, use outdated cryptographic methods, and expose information through improperly initialized memory.
Risk Assessment
An attacker could install malicious firmware, potentially leading to device compromise and privacy breaches.
Recommendation
Check for and apply any firmware updates provided by the manufacturer. Restrict network access to the devices and monitor their behavior.
Other vulnerabilities in Aqara Hub
See all- CVE-2025-65294Critical
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
- CVE-2025-65297High
Aqara Hub devices (Camera Hub G3, Hub M2, Hub M3) automatically collect and upload unencrypted sensitive information. This occurs without disclosure or consent from the manufacturer.
- CVE-2025-65296Medium
NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs.
- CVE-2025-65292High
A command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.
- CVE-2025-65291High
Aqara Hub devices (Hub M2, Hub M3, Camera Hub G3) fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
- CVE-2025-65290High
Aqara Hub devices (Camera Hub G3, Hub M2, Hub M3) fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files.
Original NVD description (English source)
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS