PT-2025-50548 · Aqara · Aqara Hub M3+2

Published 2025-12-10 · Updated 2025-12-19 · CVE-2025-65297

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aqara Hub Camera Hub G3 version 4.1.9 0027 Aqara Hub M2 version 4.3.6 0027 Aqara Hub M3 version 4.3.6 0025

Description Aqara Hub devices automatically collect and upload sensitive information in an unencrypted format. This data collection and transmission occur without any disclosure or consent from the manufacturer.

Recommendations For Aqara Hub Camera Hub G3 version 4.1.9 0027, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Aqara Hub M2 version 4.3.6 0027, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Aqara Hub M3 version 4.3.6 0025, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-5

Related Identifiers

CVE-2025-65297

Affected Products

Aqara Camera Hub G3

Aqara Hub M2

Aqara Hub M3

References · 6

• 🔥 https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Unauthorized-Data-Upload.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-65297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65297 · Security Note
• https://t.me/cveNotify/146356 · Telegram Post
• https://t.me/CVEtracker/39412 · Telegram Post
• https://twitter.com/CVEnew/status/2000248663294218462 · Twitter Post