Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Aqara Hub devices allow attackers to run malicious commands remotely

CVE-2025-65292 · published 10 months ago
Summary

Aqara's Hub devices, including Camera Hub G3, Hub M2, and Hub M3, have a security weakness that lets hackers execute unauthorized commands on the devices with superuser access. This means an attacker can take control of the device and potentially disrupt your smart home setup. Update the device software as soon as possible to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
aqara hub_m2_firmware 4.3.6_0027
cpe:2.3:o:aqara:hub_m2_firmware:4.3.6_0027:*:*:*:*:*:*:*
aqara hub_m3_firmware 4.3.6_0025
cpe:2.3:o:aqara:hub_m3_firmware:4.3.6_0025:*:*:*:*:*:*:*
aqara camera_hub_g3_firmware 4.1.9_0027
cpe:2.3:o:aqara:camera_hub_g3_firmware:4.1.9_0027:*:*:*:*:*:*:*
Original advisory text
Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges...
Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.3 High
Exploitation
1% chance of attack within 30 days
Type
CWE-77Command Injection
Timeline
Published10 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-65292 · NVD
Track software like this
Free during beta