CVE-2025-65296: Null Pointer Dereference

Published Dec 10, 2025
·
Updated

NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.60027, Hub M3 4.3.60025, and Camera Hub G3 4.1.90027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs.

Affected Software

9 affected components
Aqara Hub M2
Aqara Hub M3
Aqara Camera Hub G3
All of the following
Aqara Hub M2 Firmware=4.3.6_0027
Aqara Hub M2
All of the following
Aqara Hub M3 Firmware=4.3.6_0025
Aqara Hub M3
All of the following
Aqara Camera Hub G3 Firmware=4.1.9_0027
Aqara Camera Hub G3

Event History

Dec 10, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-65296?

CVE-2025-65296 has a high severity level due to its potential to cause denial-of-service attacks.

2

How do I fix CVE-2025-65296?

To mitigate CVE-2025-65296, update the firmware of the affected Aqara devices to the latest version provided by the vendor.

3

Which devices are affected by CVE-2025-65296?

CVE-2025-65296 affects Aqara Hub M2 (4.3.6_0027), Aqara Hub M3 (4.3.6_0025), and Aqara Camera Hub G3 (4.1.9_0027).

4

What type of vulnerability is CVE-2025-65296?

CVE-2025-65296 is identified as a NULL pointer dereference vulnerability found in JSON processing.

5

What impact can CVE-2025-65296 have on my system?

The impact of CVE-2025-65296 includes the potential for denial-of-service attacks, disrupting the normal operation of the affected devices.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203