What is the CVSS score of CVE-2025-65291?

CVE-2025-65291 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Aqara Hub are affected by CVE-2025-65291?

Aqara smart home hubs (Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027) do not verify TLS certificates when discovering and communicating with connected devices, so anyone who can…

Is there a public PoC exploit available for CVE-2025-65291?

Yes, a public proof-of-concept exploit is available for CVE-2025-65291. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-65291?

Within 24 hours, inventory all Aqara Hub M2 (4.3.6_0027), Hub M3 (4.3.6_0025), and Camera Hub G3 (4.1.9_0027) devices, confirm whether vendor patched firmware beyond these builds has been released (no vendor-released patch is identified at time of analysis), and isolate these hubs onto a dedicated IoT VLAN with strict egress filtering and no access to corporate user, server, or management networks. Within 7 days, eliminate the on-path attack surface by enforcing WPA3-Enterprise or 802.1X on the wireless infrastructure hosting the hubs, removing rogue or unmanaged access points, disabling any internet-facing discovery/CoAP gateway services that are not strictly required, and documenting compensating controls for each device with an owner and review date. Within 30 days, evaluate replacing or disabling units in sensitive areas such as executive offices or secure facilities until Aqara publishes fixed firmware, request a vendor timeline and CVE-2025-65291 remediation commitment in writing, add network monitoring for anomalous CoAP and mDNS/SSDP discovery traffic from these segments, and re-assess the risk posture once a vendor patch or an equivalent compensating-control architecture is available.

Aqara Hub CVE-2025-65291

HIGH

Improper Certificate Validation (CWE-295)

2025-12-10 cve@mitre.org

Information Disclosure Hub M2 Firmware Hub M3 Firmware Camera Hub G3 Firmware

7.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

AC:H because a privileged on-path/MITM position is required; PR:N/UI:N as no creds or interaction needed; C:H and I:H since intercepted CoAP allows reading and forging device control; A:N as availability is not impacted.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 25, 2026 - 23:51 vuln.today

CVE Published

Dec 10, 2025 - 22:16 cve.org

HIGH 7.4

DescriptionCVE.org

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.

AnalysisAI

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.

Technical ContextAI

This vulnerability stems from improper certificate validation (CWE-295) in the firmware of Aqara Hub devices. The affected components are the TLS connections used for discovery services and CoAP (Constrained Application Protocol) gateway communications. CoAP is a lightweight protocol designed for IoT devices, often secured with DTLS or TLS; here, the hub does not verify the server's certificate, accepting any certificate presented. This allows an attacker in a man-in-the-middle position to intercept, decrypt, and modify traffic between the hub and its cloud/gateway endpoints, potentially controlling or monitoring connected devices. The affected firmware builds are specifically Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027, as identified by CPEs. The attack complexity is high (AC:H) because it requires the attacker to already occupy a privileged network position, such as through ARP spoofing, DNS spoofing, or a rogue access point.

RemediationAI

No vendor-released patch has been identified at the time of analysis. Users should monitor Aqara's official channels for firmware updates and apply them promptly once available. As a compensating control, segment IoT devices like these hubs onto an isolated VLAN or network with strict egress filtering that only permits traffic to known Aqara cloud endpoints; this reduces the risk of a MITM from a compromised home network but may interfere with legitimate discovery or remote access features. Additionally, enable network monitoring to detect ARP spoofing, DNS spoofing, or rogue DHCP servers, and consider using a trusted VPN or firewall to protect CoAP traffic. Disabling discovery services, if feasible, can reduce the attack surface but may limit device functionality. Refer to the advisory at https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/CoAP-Certificate-Validation-Bypass.md for more details.