PT-2025-50542 · Aqara · Aqara Camera Hub G3

Junming Chen + 4 · Published 2025-12-10 · Updated 2025-12-14 · CVE-2025-65293

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aqara Camera Hub G3 version 4.1.9 0027

Description The Aqara Camera Hub G3 contains command injection flaws. Successful exploitation allows attackers to execute arbitrary commands with root privileges. This is achieved by providing malicious QR codes during device setup and factory reset processes.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-65293

Affected Products

Aqara Camera Hub G3

References · 5

• 🔥 https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/QR-Command-Injection.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-65293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65293 · Security Note
• https://twitter.com/VulmonFeeds/status/1998907325009072457 · Twitter Post
• https://twitter.com/CVEnew/status/2000248658772754550 · Twitter Post