CVE-2025-65290: High severity Aqara Camera Hub G3 vulnerability
Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65290?
CVE-2025-65290 is considered a critical vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2025-65290?
To fix CVE-2025-65290, users should update their Aqara Hub devices to the latest firmware that includes proper server certificate validation.
What devices are affected by CVE-2025-65290?
CVE-2025-65290 affects Aqara Camera Hub G3, Hub M2, and Hub M3 devices.
What risks are associated with CVE-2025-65290?
The risks associated with CVE-2025-65290 include the interception of firmware update traffic and the installation of potentially malicious firmware.
When was CVE-2025-65290 reported?
CVE-2025-65290 was reported in 2025, highlighting the vulnerability in several Aqara Hub firmware versions.