CVE-2025-65295
📋 TL;DR
This CVE describes vulnerabilities in Aqara Hub firmware update processes that allow attackers to install malicious firmware without proper signature validation. Attackers can exploit outdated cryptographic methods to forge valid signatures and access information through memory exposure. Users of Aqara Camera Hub G3, Hub M2, and Hub M3 devices with affected firmware versions are at risk.
💻 Affected Systems
- Aqara Camera Hub G3
- Aqara Hub M2
- Aqara Hub M3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing persistent backdoor installation, data exfiltration, and potential lateral movement to other network devices.
Likely Case
Unauthorized firmware installation leading to device malfunction, data theft, or surveillance capabilities.
If Mitigated
Limited impact with proper network segmentation and monitoring, though device integrity remains compromised.
🎯 Exploit Status
Technical details and proof-of-concept are publicly available in the GitHub repository. Exploitation requires network access to the device's update mechanism.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Monitor Aqara official channels for firmware updates. 2. When available, download official firmware from Aqara website/app. 3. Apply update through device management interface. 4. Verify firmware version after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Aqara hubs from critical network segments and internet access
Disable Automatic Updates
allPrevent automatic firmware updates that could be malicious
🧯 If You Can't Patch
- Disconnect devices from network entirely
- Replace vulnerable devices with patched alternatives
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Aqara app: Device Settings > About > Firmware VersionCheck Version:
Not applicable - check through Aqara mobile app interfaceVerify Fix Applied:
Verify firmware version has changed from vulnerable versions listed above📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware update attempts
- Failed signature verification logs
- Memory access errors
Network Indicators:
- Unusual outbound connections from hub devices
- Firmware download from non-Aqara sources
- UDP/TCP traffic on update ports
SIEM Query:
source="aqara_hub" AND (event="firmware_update" OR event="signature_failure")