CVE-2026-50091

CriticalCVSS 9.1

Published: 12/06/2026(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

Aqara Home Android app (version 6.0.0) and white-label clients embedding the same liblumidevsdk.so library use hard-coded cryptographic keys (CWE-321). This allows an unauthenticated remote attacker to compromise confidentiality and integrity of data with a CVSS score of 9.1 (Critical).

Risk Assessment

The organization faces remote data breach and tampering risks, potentially leading to user privacy violations and loss of trust in the system.

Recommendation

Immediately update the Aqara Home app to the latest version that removes hard-coded keys and enforce the update for all users. For custom white-label clients, replace the liblumidevsdk.so library with a patched version.

Original NVD description (English source)

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).