CVE-2025-65297
📋 TL;DR
Aqara Hub devices automatically collect and upload unencrypted sensitive information without user consent or manufacturer disclosure. This vulnerability allows unauthorized data exfiltration affecting users of Camera Hub G3, Hub M2, and Hub M3 devices.
💻 Affected Systems
- Aqara Camera Hub G3
- Aqara Hub M2
- Aqara Hub M3
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all sensitive data collected by the devices including video feeds, device metadata, and network information being transmitted to unauthorized third parties.
Likely Case
Persistent collection and transmission of personal data including device usage patterns, network configurations, and potentially video/audio data without user knowledge.
If Mitigated
Limited data exposure if devices are isolated from sensitive networks and internet access is restricted.
🎯 Exploit Status
The vulnerability requires no authentication and data collection occurs automatically. Public GitHub repository contains detailed analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Monitor Aqara security advisories for updates.
🔧 Temporary Workarounds
Network Isolation
allPlace Aqara Hub devices on isolated VLAN with restricted internet access
Firewall Rules
allBlock all outbound traffic from Aqara devices except essential cloud services
🧯 If You Can't Patch
- Disconnect devices from internet entirely and use only locally
- Replace affected devices with alternative products from different vendors
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in Aqara app: Settings > About > Firmware VersionCheck Version:
Not applicable - check via Aqara mobile application interfaceVerify Fix Applied:
Monitor network traffic from devices to confirm no unencrypted sensitive data transmission📡 Detection & Monitoring
Log Indicators:
- Unusual outbound data transfers from IoT devices
- Large volumes of data sent to unknown external IPs
Network Indicators:
- Unencrypted HTTP traffic from Aqara devices containing sensitive data
- Regular data uploads to cloud endpoints
SIEM Query:
source_ip IN (aqara_device_ips) AND protocol = 'http' AND (payload_contains 'sensitive' OR size > 1MB)