Aqara Hub CVE-2025-65297

No vendor-released patch or fixed firmware version is identified in the available data for Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, or Hub M3 4.3.6_0025, so remediation is currently mitigation-based while users press Aqara for a firmware update that encrypts the upload channel and adds explicit consent. The most effective compensating control is to treat the hubs as untrusted endpoints and isolate them: place every affected hub on a dedicated VLAN or separate SSID with a unique WPA2/WPA3 pre-shared key, so that no other device on the local segment can passively capture the hub's cleartext egress (trade-off: this breaks local discovery/integration with phones, NAS, and other smart-home systems that share the LAN, and requires re-pairing the device). Layer on egress filtering at the router/firewall to allow the hub to reach only the specific Aqara cloud endpoints it needs and to drop everything else, which both shrinks the exfiltration surface and generates logs of the plaintext sessions (trade-off: overly strict rules will break remote control and app notifications, so build the allowlist from observed flows first). Where the Aqara Home app exposes telemetry, analytics, or cloud-sync toggles, disable them and verify with a packet capture whether uploads actually stop - the report indicates the behavior occurs by default and may not be user-disableable, in which case full isolation plus upstream monitoring is the only practical containment. Do not rely on a VPN or encrypted overlay on the router as the sole fix: it protects against upstream on-path observers but still leaves the hub-to-router hop in cleartext on the LAN. Until a fixed firmware exists, monitor https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Unauthorized-Data-Upload.md and Aqara's support channels for an advisory, and report any plaintext upload endpoints seen in captures to the vendor.