CVE-2025-65293: Command Injection

Published Dec 10, 2025

Updated

Command injection vulnerabilities in Aqara Camera Hub G3 4.1.90027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset.

Affected Software

3 affected components

Aqara Camera Hub G3

All of the following

Aqara Camera Hub G3 Firmware=4.1.9_0027

Aqara Camera Hub G3

Event History

Dec 10, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-65293?

CVE-2025-65293 is classified as a high-severity vulnerability due to the potential for arbitrary command execution with root privileges.

How do I fix CVE-2025-65293?

To mitigate CVE-2025-65293, update the Aqara Camera Hub G3 to the latest firmware version that addresses this command injection vulnerability.

What systems are affected by CVE-2025-65293?

CVE-2025-65293 affects the Aqara Camera Hub G3 firmware version 4.1.9_0027.

What types of attacks are possible with CVE-2025-65293?

CVE-2025-65293 allows attackers to use malicious QR codes to execute arbitrary commands on the device.

Can CVE-2025-65293 be exploited remotely?

Yes, CVE-2025-65293 can be exploited remotely during the setup and factory reset process via malicious QR codes.