Hub M3 Firmware vulnerabilities

6 known vulnerabilities in Hub M3 Firmware from Aqara. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Hub M2 Firmware: J2EE Misconfiguration: Data Transmission Without Encryption

  CVE-2025-65297Dec 10, 2025Aqara

  Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.

• 8.1 High severity

  Hub M2 Firmware: Inadequate Encryption Strength

  CVE-2025-65295Dec 10, 2025Aqara

  Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware si

• 9.8 Critical severity

  Hub M2 Firmware: Improper Control of Generation of Code

  CVE-2025-65294Dec 10, 2025AqaraEPSS 1.93%

  Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.

• 7.3 High severity

  Hub M2 Firmware: Improper Neutralization of Special Elements used in a Command

  CVE-2025-65292Dec 10, 2025AqaraEPSS 1.47%

  Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.

• 7.4 High severity

  Hub M2 Firmware: Improper Certificate Validation

  CVE-2025-65291Dec 10, 2025Aqara

  Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and

• 7.4 High severity

  Hub M2 Firmware: Improper Certificate Validation

  CVE-2025-65290Dec 10, 2025Aqara

  Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve