CVEvulnerability

CVE-2025-65295

8.1 HIGH Published 2025-12-10 Modified 2026-09-25 Official page ↗
Status
Analyzed
Published
2025-12-10
Last modified
2026-09-25
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-326, CWE-347, CWE-457

Description

Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.

Affected configurations

• aqara hub m2 firmware 4.3.6 0027 • aqara hub m3 firmware 4.3.6 0025 • aqara camera hub g3 firmware 4.1.9 0027

Related

Weakness · CWE (3)

  • CWE-326 Inadequate Encryption Strength weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness
  • CWE-457 Use of Uninitialized Variable weakness

References