CVE-2025-65291: High severity Aqara Hub M2 vulnerability
Aqara Hub devices including Hub M2 4.3.60027, Hub M3 4.3.60025, Camera Hub G3 4.1.90027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65291?
CVE-2025-65291 has been classified as a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2025-65291?
To fix CVE-2025-65291, update your Aqara Hub M2, Hub M3, or Camera Hub G3 to the latest firmware version that addresses this certificate validation issue.
What types of devices are affected by CVE-2025-65291?
CVE-2025-65291 affects Aqara Hub M2, Hub M3, and Camera Hub G3 devices running specific firmware versions.
What vulnerabilities does CVE-2025-65291 expose?
CVE-2025-65291 exposes devices to man-in-the-middle attacks which can compromise control and monitoring communications.
Is my Aqara Hub device at risk from CVE-2025-65291?
If you are using Aqara Hub M2, Hub M3, or Camera Hub G3 with the affected firmware versions, your device is at risk from CVE-2025-65291.