PT-2025-50535 · Aqara · Aqara Hub M2+2

Chapoly1305 · Publicado 2025-12-10 · Atualizado 2025-12-14 · CVE-2025-65290

Positive Technologies (AI Summary)

CVSS v3.1

7.4

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Aqara Camera Hub G3 version 4.1.9 0027 Aqara Hub M2 version 4.3.6 0027 Aqara Hub M3 version 4.3.6 0025

Description Aqara Hub devices do not properly validate server certificates when downloading firmware updates over HTTPS. This allows attackers positioned between the device and the update server to intercept the communication and potentially replace legitimate firmware with malicious versions.

Recommendations Update Aqara Camera Hub G3 to a version newer than 4.1.9 0027. Update Aqara Hub M2 to a version newer than 4.3.6 0027. Update Aqara Hub M3 to a version newer than 4.3.6 0025.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2025-65290

Produtos afetados

Aqara Camera Hub G3

Aqara Hub M2

Aqara Hub M3

Referências · 4

• 🔥 https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/OTA-Certificate-Validation-Bypass.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65290 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-65290 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2000248655304077510 · Publicação no Twitter