CVE-2025-65292
📋 TL;DR
A command injection vulnerability in Aqara Hub devices allows attackers to execute arbitrary commands with root privileges by exploiting malicious domain names. This affects Aqara Camera Hub G3, Hub M2, and Hub M3 devices running specific vulnerable firmware versions. Attackers can gain complete control over affected devices.
💻 Affected Systems
- Aqara Camera Hub G3
- Aqara Hub M2
- Aqara Hub M3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, data exfiltration, lateral movement to other network devices, and participation in botnets.
Likely Case
Remote code execution leading to device takeover, surveillance compromise (for camera models), and credential harvesting from the local network.
If Mitigated
Limited impact if devices are isolated on separate VLANs with strict egress filtering and no internet exposure.
🎯 Exploit Status
Exploitation details are publicly available in GitHub repository. Attack requires DNS poisoning or user interaction with malicious domains.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Monitor Aqara security advisories for updates. Consider workarounds or device replacement if critical.
🔧 Temporary Workarounds
DNS Filtering and Isolation
linuxBlock external DNS resolution and restrict device network access
iptables -A OUTPUT -p udp --dport 53 -j DROP
iptables -A OUTPUT -p tcp --dport 53 -j DROP
Network Segmentation
allIsolate Aqara devices on separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Disconnect devices from internet and use local-only mode if supported
- Replace vulnerable devices with patched alternatives from different vendors
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in Aqara app or web interface. If version matches affected list, device is vulnerable.Check Version:
Check via Aqara mobile app: Device Settings > About > Firmware VersionVerify Fix Applied:
Verify firmware version has been updated beyond vulnerable versions listed.📡 Detection & Monitoring
Log Indicators:
- Unusual DNS queries from hub devices
- Unexpected process execution logs
- Failed authentication attempts from hub IP
Network Indicators:
- DNS requests to suspicious domains from hub devices
- Unexpected outbound connections from hub devices
- Port scanning originating from hub IP
SIEM Query:
source="aqara_hub" AND (event_type="process_execution" OR dns_query="*;*" OR dns_query="*|*")