← Back

CVE-2025-65297

nvd nist
Published: Dec 10, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.

Affected (3)

Aqara
3 products
Hub M2 Firmware
Hub M3 Firmware
Camera Hub G3 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Hub M2 Firmware
Version 4.3.6_0027
Running on/withPlatform Versions
Aqara
Hub M2
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Hub M3 Firmware
Version 4.3.6_0025
Running on/withPlatform Versions
Aqara
Hub M3
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Camera Hub G3 Firmware
Version 4.1.9_0027
Running on/withPlatform Versions
Aqara
Camera Hub G3
All versions

Related CWEs

CWE-5
J2EE Misconfiguration: Data Transmission Without Encryption
Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

References (1)

Source: cve@mitre.org
Third Party Advisory

Timeline

No history available yet.