Description
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
Affected products
aqara: hub m2 firmware; aqara: hub m2; aqara: hub m3 firmware; aqara: hub m3; aqara: camera hub g3 firmware; aqara: camera hub g3
References1
- github.com/Chapoly1305/myCVEReports/blob/main/Aqara/OTA-Firmwar… ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
8.1
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 17 · as of 11 November 2026
- CWE
- CWE-326CWE-347CWE-457
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.