CVE-2025-65295: Weak Encryption
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65295?
CVE-2025-65295 is considered critical due to the potential for attackers to install malicious firmware.
How do I fix CVE-2025-65295?
To fix CVE-2025-65295, ensure that your Aqara Hub firmware is updated to the latest patched version provided by the manufacturer.
What devices are affected by CVE-2025-65295?
CVE-2025-65295 affects Aqara Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices.
What are the risks associated with CVE-2025-65295?
The risks include unauthorized firmware installation which can lead to compromised device security and privacy.
Is there a workaround for CVE-2025-65295?
Currently, the best mitigation for CVE-2025-65295 is to refrain from using the affected devices until a firmware update is applied.