What is the CVSS score of CVE-2026-50091?

CVE-2026-50091 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Com Lumiunited Aqarahome are affected by CVE-2026-50091?

Aqara Home Android app 6.0.0 contains hard-coded cryptographic keys in the shipped binary, making all device communications vulnerable to decryption and tampering.. A patch is available.

How to fix or mitigate CVE-2026-50091?

Within 24 hours: Identify Aqara Home app deployments and current versions in your organization. Within 7 days: Deploy the vendor-released patched version per Aqara security advisory across all instances. Within 30 days: Audit access logs and device communications during the exposure window for indicators of unauthorized access or tampering.

Com Lumiunited Aqarahome CVE-2026-50091

EUVD-2026-36481 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-06-12 runZero

GHSA-27qj-3j3m-fj5v

Information Disclosure Google Com Lumiunited Aqarahome Aqara

7.4

CVSS 3.1 · NVD

Severity by source

Vendor (runZero) PRIMARY

CRITICAL

qualitative

NVD

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Keys are extractable without auth (PR:N), but weaponizing them requires intercepting the traffic they protect, so AC:H; high confidentiality and integrity impact, no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (runZero).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 09, 2026 - 18:04 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 09, 2026 - 18:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 09, 2026 - 17:52 vuln.today

cvss_changed

Severity Changed

Jul 09, 2026 - 17:52 NVD

CRITICAL HIGH

CVSS changed

Jul 09, 2026 - 17:52 NVD

9.1 (CRITICAL) 7.4 (HIGH)

Re-analysis Queued

Jul 09, 2026 - 17:52 vuln.today

cvss_changed

Severity Changed

Jul 09, 2026 - 17:52 NVD

CRITICAL HIGH

CVSS changed

Jul 09, 2026 - 17:52 NVD

9.1 (CRITICAL) 7.4 (HIGH)

Patch available

Jun 12, 2026 - 17:01 EUVD

Analysis Generated

Jun 12, 2026 - 16:25 vuln.today

CVE Published

Jun 12, 2026 - 15:02 cve.org

CRITICAL 9.1

DescriptionNVD

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).

AnalysisAI

Hard-coded cryptographic keys in the Aqara Home Android app (com.lumiunited.aqarahome) 6.0.0 and white-label clients embedding the same liblumidevsdk.so let attackers who extract the static keys from the shipped binary decrypt protected data and forge or tamper with device/cloud communications. Because every install ships the identical embedded keys, a single extraction compromises confidentiality and integrity across the entire installed base. Reported by runZero (CVE-2026-50091 / EUVD-2026-36481); publicly available exploit code exists (GitHub PoC 'theres-no-place-like-home'), but it is not on CISA KEV and EPSS is very low at 0.03%.