← Back

CVE-2025-65294

nvd nist
Published: Dec 10, 2025Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.

Affected (3)

Aqara
3 products
Hub M2 Firmware
Hub M3 Firmware
Camera Hub G3 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Hub M2 Firmware
Version 4.3.6_0027
Running on/withPlatform Versions
Aqara
Hub M2
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Hub M3 Firmware
Version 4.3.6_0025
Running on/withPlatform Versions
Aqara
Hub M3
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Camera Hub G3 Firmware
Version 4.1.9_0027
Running on/withPlatform Versions
Aqara
Camera Hub G3
All versions

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

Source: cve@mitre.org
Not Applicable
Source: cve@mitre.org
ExploitThird Party Advisory

Timeline

No history available yet.