CVE-2025-65294
📋 TL;DR
Aqara Hub devices contain an undocumented remote access mechanism that allows attackers to execute arbitrary commands without authentication. This vulnerability affects Aqara Camera Hub G3, Hub M2, and Hub M3 devices running specific vulnerable firmware versions. Attackers can gain complete control over affected devices remotely.
💻 Affected Systems
- Aqara Camera Hub G3
- Aqara Hub M2
- Aqara Hub M3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install malware, pivot to internal networks, steal sensitive data, or use devices as botnet nodes.
Likely Case
Remote attackers gaining full control of devices to monitor camera feeds, manipulate smart home devices, or use devices for DDoS attacks.
If Mitigated
Limited impact if devices are isolated from internet and internal networks with strict network segmentation.
🎯 Exploit Status
Public GitHub repositories contain detailed exploitation techniques. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Monitor Aqara security advisories for updates. Check device firmware updates through Aqara app.
🔧 Temporary Workarounds
Network Isolation
allIsolate Aqara Hub devices from internet and internal networks using VLANs or separate network segments.
Firewall Restrictions
allBlock all inbound traffic to Aqara Hub devices except from authorized management systems.
🧯 If You Can't Patch
- Immediately disconnect vulnerable devices from internet and internal networks
- Replace vulnerable devices with patched versions or alternative products
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Aqara app: Settings > About > Firmware Version. Compare against affected versions.Check Version:
No CLI command available. Use Aqara mobile app to check firmware version.Verify Fix Applied:
Verify firmware version has been updated to a version not listed in affected systems.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution logs
- Unexpected process creation
- Network connections to suspicious external IPs
Network Indicators:
- Unexpected outbound connections from hub devices
- Traffic to known malicious IPs
- Unusual protocol usage on hub ports
SIEM Query:
source="aqara_hub" AND (event_type="command_execution" OR process_name NOT IN ["normal_processes"])