What is the CVSS score of CVE-2025-65294?

CVE-2025-65294 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Aqara Hub are affected by CVE-2025-65294?

An unauthenticated remote command execution flaw affects Aqara Camera Hub G3, Hub M2, and Hub M3 firmware, allowing anyone who can reach these devices over the network to run arbitrary commands…

Is there a public PoC exploit available for CVE-2025-65294?

Yes, a public proof-of-concept exploit is available for CVE-2025-65294. Prioritise patching immediately. EPSS: 1.0%.

How to fix or mitigate CVE-2025-65294?

Within 24 hours, inventory every Aqara Camera Hub G3 (firmware 4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) on our estate, confirm which are reachable from untrusted or broad internal networks, and immediately block all inbound access to those devices at the perimeter and inter-VLAN firewalls, placing them on an isolated IoT segment with no path to corporate systems. Within 7 days, engage Aqara support and our reseller to obtain a fixed firmware release or formal vendor guidance, disable any cloud/remote-management features not strictly required, restrict administrative interfaces to a dedicated management VLAN with allow-listed source addresses, and enable logging and alerting on outbound traffic from these hubs. Within 30 days, if no vendor fix is available, evaluate replacement or compensating hardware for any hub that must remain internet- or broadly network-reachable, and formalize a policy requiring IoT and physical-security devices to sit on segmented networks with default-deny egress. Note that public exploit code exists and no vendor-released patch has been identified at time of analysis, so containment must be achieved through network controls rather than patching.

Aqara Hub CVE-2025-65294

CRITICAL

Code Injection (CWE-94)

2025-12-10 cve@mitre.org

RCE IoT Code Injection Aqara Hub M2 Firmware Hub M3 Firmware Camera Hub G3 Firmware

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Undocumented remote mechanism gives unauthenticated network command execution (AV:N/AC:L/PR:N/UI:N) with full device compromise, yielding C:H/I:H/A:H on the device itself (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: Aqara added

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: IoT added

Analysis Generated

Sep 25, 2026 - 23:50 vuln.today

CVE Published

Dec 10, 2025 - 22:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.

AnalysisAI

Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stems from an undocumented remote access mechanism that lets network-reachable attackers run arbitrary commands without authentication or user interaction. The issue is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though no CISA KEV record is provided confirming active exploitation. EPSS is 0.98% (61st percentile), indicating lower modeled near-term exploitation probability despite the severe impact if reachable.

Technical ContextAI

The affected devices are Aqara smart-home hub firmware images identified by CPEs cpe:2.3:o:aqara:camera_hub_g3_firmware:4.1.9_0027:*:*:*:*:*:*:*, cpe:2.3:o:aqara:hub_m2_firmware:4.3.6_0027:*:*:*:*:*:*:*, and cpe:2.3:o:aqara:hub_m3_firmware:4.3.6_0025:*:*:*:*:*:*:*. The root cause is CWE-94 (Code Injection): an undocumented remote access mechanism in the firmware accepts attacker-controlled commands without adequate validation or authorization, enabling arbitrary command execution. Assessment notes no special software configuration is required, and the main limiting factor is network reachability: internet-exposed hubs are directly at risk, while devices behind home NAT or a firewall are exploitable from the local network or via a pivot. One referenced path, QR-Command-Injection, may additionally require a crafted QR code to be presented to the device, adding a proximity or interaction constraint for that specific vector.

RemediationAI

No vendor-released patch identified at time of analysis; owners of affected Aqara Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, or Hub M3 4.3.6_0025 firmware should treat the devices as exposed and isolate them until a fix is available. Primary actions are to remove any inbound internet exposure for the hubs, avoid port-forwarding their services, place them on a dedicated IoT VLAN with strict outbound filtering, and restrict management access to trusted local hosts only. These controls can break cloud/app remote access and automation integrations, so validate functionality after applying. If the QR command path is relevant, limit who can present QR codes to the device and monitor for unexpected command activity. Monitor Aqara firmware release channels and the referenced reports at https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/QR-Command-Injection.md and https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Undocumented-Remote-Execution.md for updated guidance or a fixed firmware version.