CVE-2025-65296
📋 TL;DR
A NULL-pointer dereference vulnerability in Aqara smart home hubs allows attackers to cause denial-of-service by sending malformed JSON inputs. This affects Aqara Hub M2, Hub M3, and Camera Hub G3 devices running specific vulnerable firmware versions. The vulnerability can crash the device's JSON processing functionality.
💻 Affected Systems
- Aqara Hub M2
- Aqara Hub M3
- Aqara Camera Hub G3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Device becomes completely unresponsive, requiring physical restart or factory reset, disrupting all connected smart home devices and services.
Likely Case
Temporary service disruption affecting specific JSON-dependent functions until device automatically restarts or requires manual intervention.
If Mitigated
Minimal impact with proper network segmentation and input validation in place, potentially causing only isolated service interruptions.
🎯 Exploit Status
Exploitation requires network access to the device but no authentication. The GitHub reference contains technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check Aqara official website/app for firmware updates
2. If update available, apply through Aqara app
3. Monitor for vendor security advisory
🔧 Temporary Workarounds
Network Segmentation
allIsolate Aqara hubs from untrusted networks and internet exposure
Firewall Rules
linuxRestrict network access to Aqara hubs to only trusted IP addresses
iptables -A INPUT -s [TRUSTED_IP] -p tcp --dport [HUB_PORT] -j ACCEPT
iptables -A INPUT -p tcp --dport [HUB_PORT] -j DROP
🧯 If You Can't Patch
- Segment network to isolate Aqara devices from untrusted traffic
- Implement network monitoring for malformed JSON payloads targeting hub devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in Aqara app: Settings > About > Firmware VersionCheck Version:
Check via Aqara mobile app interface onlyVerify Fix Applied:
Verify firmware version has been updated beyond vulnerable versions listed📡 Detection & Monitoring
Log Indicators:
- Device crash/restart logs
- JSON parsing errors
- Unexpected service termination
Network Indicators:
- Malformed JSON payloads sent to hub ports
- Unusual traffic patterns to hub management interfaces
SIEM Query:
source="aqara_hub" AND (event="crash" OR event="restart" OR message="*JSON*error*")