What is the CVSS score of CVE-2025-65295?

CVE-2025-65295 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Aqara Hub are affected by CVE-2025-65295?

Organizations using Aqara Camera Hub G3, Hub M2, or Hub M3 are exposed to a high-severity firmware validation flaw that allows an unauthenticated remote attacker to install malicious firmware,…

Is there a public PoC exploit available for CVE-2025-65295?

Yes, a public proof-of-concept exploit is available for CVE-2025-65295. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-65295?

Within 24 hours, identify all instances of Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) on your network, isolate them on a dedicated VLAN with strict egress filtering, and disable automatic firmware updates if feasible to prevent unauthorized OTA delivery; within 7 days, enforce that all firmware updates are only accepted from a trusted internal server with cryptographic verification, monitor device behavior for anomalous outbound connections or firmware changes, and engage Aqara support to obtain a timeline for a fixed firmware release; within 30 days, as no vendor-released patch identified at time of analysis, evaluate replacing these hubs with alternative products that properly validate firmware signatures, or implement additional compensating controls such as network-based firmware integrity monitoring and continuous asset tracking, and prepare a contingency plan to disconnect affected devices if exploitation is detected.

Aqara Hub CVE-2025-65295

HIGH

Inadequate Encryption Strength (CWE-326)

2025-12-10 cve@mitre.org

Information Disclosure IoT Hub M2 Firmware Hub M3 Firmware Camera Hub G3 Firmware

8.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-delivered firmware attack (AV:N) but requires MITM positioning or forging signatures against weak crypto (AC:H), no auth (PR:N); malicious firmware yields full device compromise (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: IoT added

Analysis Generated

Sep 25, 2026 - 23:49 vuln.today

CVE Published

Dec 10, 2025 - 22:16 cve.org

HIGH 8.1

DescriptionCVE.org

Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.

AnalysisAI

Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.

Technical ContextAI

The affected code is the firmware update (OTA) subsystem of Aqara smart-home hubs, which is classified under CWE-326 (Inadequate Encryption Strength). Three distinct weaknesses compound: firmware signature validation is missing or bypassable during updates, the signing scheme uses outdated cryptographic methods whose weakness permits forgery of a valid-looking signature, and improperly initialized memory leaks information that can further aid an attacker in defeating verification. Because the device trusts the update package, an attacker who can place a crafted image into the update path - for example by man-in-the-middle positioning on the OTA channel - gains persistent control of the hub. The CVSS:3.1:AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H vector supplied by the source matches the independent assessment: network-reachable, unauthenticated, no user interaction, but high complexity due to the interception or forgery requirement, with high confidentiality, integrity, and availability impact. Affected CPEs are cpe:2.3:o:aqara:camera_hub_g3_firmware:4.1.9_0027, cpe:2.3:o:aqara:hub_m2_firmware:4.3.6_0027, and cpe:2.3:o:aqara:hub_m3_firmware:4.3.6_0025, indicating the flaw is present in these specific firmware builds. The information-disclosure and signature-forgery aspects are consistent with research published at https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/OTA-Firmware-Insecurity.md.

RemediationAI

No vendor-released patch or fixed firmware version was identified at the time of analysis, so remediation must rely on compensating controls until Aqara publishes updated firmware. Because exploitation requires delivering a crafted image to the update mechanism, isolate the hubs on a dedicated VLAN or IoT SSID with no lateral access to trusted hosts, and block or strictly monitor the hubs' OTA/update endpoints at the egress firewall so firmware traffic can only traverse a trusted path - the trade-off is that this also prevents legitimate automatic updates and must be paired with a manual update process. Where the update channel can be tunneled, enforce TLS interception/validation on a managed gateway to detect man-in-the-middle tampering with firmware downloads; this adds administrative overhead and certificate-management risk on IoT networks. Consider disabling automatic firmware updates entirely (repeatable manual, out-of-band flashing instead) so that an unexpected OTA push cannot be silently applied - the trade-off is delayed security fixes and more operational effort. Monitor hubs for unexpected firmware version changes, reboots, or outbound connections to unfamiliar hosts as a detection measure. Track the researcher report at https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/OTA-Firmware-Insecurity.md and Aqara's support channels for a patched firmware release, and apply it as soon as an exact fixed build is published; this CVE is not listed in CISA KEV and has an EPSS score of only 0.23% (13th percentile), so scheduling these mitigations rather than emergency action is reasonable, though publicly available exploit code exists.