CVE-2025-65292

A command injection vulnerability exists in several Aqara Hub devices, specifically the Camera Hub G3 (version 4.1.9_0027), Hub M2 (version 4.3.6_0027), and Hub M3 (version 4.3.6_0025). The root cause is the improper neutralization of special elements used in a command, which allows an attacker t...

CVE-2025-65296

Several Aqara smart home products are susceptible to NULL-pointer dereference vulnerabilities during JSON processing . Specifically, these issues affect the Aqara Hub M2 (version 4.3.6_0027) , Hub M3 (version 4.3.6_0025) , and Camera Hub G3 (version 4.1.9_0027) . An attacker can provide malformed...

CVE-2025-65297

Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer...

PT-2025-50536

Name of the Vulnerable Software and Affected Versions Aqara Hub M2 version 4.3.6 0027 Aqara Hub M3 version 4.3.6 0025 Aqara Camera Hub G3 version 4.1.9 0027 Description Aqara Hub devices do not properly validate server certificates during TLS connections used for discovery services and CoAP gatew...

CVE-2025-65291

Aqara Hub devices including Hub M2 4.3.60027, Hub M3 4.3.60025, Camera Hub G3 4.1.90027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring...

PT-2025-50548

Name of the Vulnerable Software and Affected Versions Aqara Hub Camera Hub G3 version 4.1.9 0027 Aqara Hub M2 version 4.3.6 0027 Aqara Hub M3 version 4.3.6 0025 Description Aqara Hub devices automatically collect and upload sensitive information in an unencrypted format. This data collection and...