Camera Hub G3 Firmware
Monthly
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Malformed JSON delivered to Aqara Hub M2 (4.3.6_0027), Hub M3 (4.3.6_0025), and Camera Hub G3 (4.1.9_0027) firmware crashes the JSON-processing routine through a NULL-pointer dereference, causing a denial of service on the affected hub. The vulnerability is only reachable by an attacker positioned on the same adjacent/local network as the device (AV:A, PR:N, UI:N), so it is not exploitable directly from the internet, and impact is limited to availability - no confidentiality or integrity loss is assessed. Publicly available exploit code exists (a GitHub write-up demonstrating the malformed-JSON trigger), but there is no CISA KEV confirmation of active exploitation, and EPSS is low at 0.28% (19th percentile), reflecting the adjacent-network prerequisite; overall this is a genuine but low-priority issue.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stems from an undocumented remote access mechanism that lets network-reachable attackers run arbitrary commands without authentication or user interaction. The issue is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though no CISA KEV record is provided confirming active exploitation. EPSS is 0.98% (61st percentile), indicating lower modeled near-term exploitation probability despite the severe impact if reachable.
Arbitrary command execution with root privileges is possible on Aqara Camera Hub G3 devices running firmware 4.1.9_0027 when the hub scans a maliciously crafted QR code during initial device setup or a factory reset. Because the attack vector is physical (CVSS AV:P) and requires a user or operator to perform the scan action (UI:R), exploitation is limited to those provisioning windows and is not possible against an already-configured hub in normal operation; the CVSS 3.1 base score is 6.6. Publicly available exploit code exists (a detailed PoC write-up is published), but the vulnerability is not confirmed as actively exploited (not in CISA KEV), and EPSS is low at 1.11% (64th percentile).
Command injection in Aqara hub firmware - Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 - lets an attacker who can get the device to process an attacker-controlled domain name/hostname execute arbitrary commands with root privileges. Delivery is gated: the CVSS vector (AV:L/AC:L/PR:L/UI:R) indicates local-network-adjacent access, low-privileged credentials (e.g. a paired companion-app session), and a user-triggered action are required; our own assessment raises the access vector to AV:A (adjacent network) because 'malicious domain names' implies DNS/network-borne delivery rather than physical console access. Publicly available exploit code exists (a detailed GitHub write-up), but the flaw is not in CISA KEV and EPSS is modest at 0.80% (55th percentile), so exploitation in the wild is not confirmed; only the exact firmware builds listed are confirmed affected.
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.
Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.
Malformed JSON delivered to Aqara Hub M2 (4.3.6_0027), Hub M3 (4.3.6_0025), and Camera Hub G3 (4.1.9_0027) firmware crashes the JSON-processing routine through a NULL-pointer dereference, causing a denial of service on the affected hub. The vulnerability is only reachable by an attacker positioned on the same adjacent/local network as the device (AV:A, PR:N, UI:N), so it is not exploitable directly from the internet, and impact is limited to availability - no confidentiality or integrity loss is assessed. Publicly available exploit code exists (a GitHub write-up demonstrating the malformed-JSON trigger), but there is no CISA KEV confirmation of active exploitation, and EPSS is low at 0.28% (19th percentile), reflecting the adjacent-network prerequisite; overall this is a genuine but low-priority issue.
Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.
Remote command execution in Aqara Hub firmware (Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025) stems from an undocumented remote access mechanism that lets network-reachable attackers run arbitrary commands without authentication or user interaction. The issue is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and publicly available exploit code exists, though no CISA KEV record is provided confirming active exploitation. EPSS is 0.98% (61st percentile), indicating lower modeled near-term exploitation probability despite the severe impact if reachable.
Arbitrary command execution with root privileges is possible on Aqara Camera Hub G3 devices running firmware 4.1.9_0027 when the hub scans a maliciously crafted QR code during initial device setup or a factory reset. Because the attack vector is physical (CVSS AV:P) and requires a user or operator to perform the scan action (UI:R), exploitation is limited to those provisioning windows and is not possible against an already-configured hub in normal operation; the CVSS 3.1 base score is 6.6. Publicly available exploit code exists (a detailed PoC write-up is published), but the vulnerability is not confirmed as actively exploited (not in CISA KEV), and EPSS is low at 1.11% (64th percentile).
Command injection in Aqara hub firmware - Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 - lets an attacker who can get the device to process an attacker-controlled domain name/hostname execute arbitrary commands with root privileges. Delivery is gated: the CVSS vector (AV:L/AC:L/PR:L/UI:R) indicates local-network-adjacent access, low-privileged credentials (e.g. a paired companion-app session), and a user-triggered action are required; our own assessment raises the access vector to AV:A (adjacent network) because 'malicious domain names' implies DNS/network-borne delivery rather than physical console access. Publicly available exploit code exists (a detailed GitHub write-up), but the flaw is not in CISA KEV and EPSS is modest at 0.80% (55th percentile), so exploitation in the wild is not confirmed; only the exact firmware builds listed are confirmed affected.
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.
Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).