CVE-2026-50085: Aqara Board IoT insecure debug API
The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated CVSS ofCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (8.6 High). When combined with CVE-2026-50082, CVE-50083, and CVE-50084, this can lead to a fully unauthenticated, remote takeover of affected devices.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the insecure debug API that accepts arbitrary MQTT command payloads, or require strong authentication and authorization on the service before accepting or forwarding any MQTT payloads.
Aqara Board service (op-test.aqara.com) debug API / anonymous MQTT forwarding = disabled or require authentication - Configuration
Enable and enforce authentication and authorization on the HiveMQ broker so the broker only accepts MQTT clients and messages from authenticated/authorized sources.
HiveMQ broker authentication_required = true - Configuration
Implement strict server-side validation and command authorization for incoming MQTT payloads; only allow well-formed, authorized commands and reject arbitrary payloads.
Aqara Board service (op-test.aqara.com) MQTT payload validation = enforced - Compensating control
Restrict network access to op-test.aqara.com and the HiveMQ broker to trusted management networks or IP ranges using firewall rules, ACLs, VPNs, or network segmentation to prevent unauthenticated external access.
- Operational
Audit logs and telemetry for signs of unauthorized MQTT commands or suspicious activity, isolate affected devices or services if compromise is suspected, and perform incident response investigations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50085?
CVE-2026-50085 has a severity rating of high with a score of 8.6.
What types of attacks can be performed due to CVE-2026-50085?
CVE-2026-50085 allows attackers to send arbitrary MQTT commands without authentication, potentially compromising the IoT system.
How do I fix CVE-2026-50085?
To mitigate CVE-2026-50085, secure the API by implementing authentication measures for MQTT command payloads.
What is the impact of CVE-2026-50085 on data integrity?
CVE-2026-50085 can lead to compromised data integrity, as unauthorized users can send malicious commands.
Is there a workaround for CVE-2026-50085 until a patch is available?
As a temporary workaround for CVE-2026-50085, limit exposure of the vulnerable service and monitor MQTT traffic closely.