CVE-2025-65293
📋 TL;DR
This CVE describes a command injection vulnerability in Aqara Camera Hub G3 devices that allows attackers to execute arbitrary commands with root privileges by scanning malicious QR codes during device setup or factory reset. This affects users of Aqara Camera Hub G3 devices who perform setup or reset procedures. Attackers can gain complete control of the device through this physical access vector.
💻 Affected Systems
- Aqara Camera Hub G3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent root access, data exfiltration, lateral movement in the network, and use as a pivot point for further attacks.
Likely Case
Local attacker gains root access to the camera hub, potentially compromising connected cameras and accessing video feeds or network credentials.
If Mitigated
Limited impact if QR code scanning is restricted to trusted sources and physical access is controlled.
🎯 Exploit Status
Exploitation requires physical access to scan malicious QR code during setup/reset. Public GitHub repository contains technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check Aqara official website or support channels for firmware updates addressing CVE-2025-65293. No official patch information available at this time.
🔧 Temporary Workarounds
Physical Access Control
allRestrict physical access to devices during setup and factory reset procedures
QR Code Source Verification
allOnly use QR codes from trusted official sources during device setup
🧯 If You Can't Patch
- Isolate affected devices on separate network segments
- Monitor for unusual network activity from camera hub devices
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in Aqara app or web interface. If version is 4.1.9_0027, device is vulnerable.Check Version:
Check via Aqara mobile app: Device Settings > About > Firmware VersionVerify Fix Applied:
Verify firmware version has been updated beyond 4.1.9_0027 through official Aqara update channels.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution during setup process
- QR code scanning errors with suspicious payloads
Network Indicators:
- Unexpected outbound connections from camera hub
- Unusual network traffic patterns post-setup
SIEM Query:
Search for process execution events containing shell commands from camera hub setup processes