Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
4 versions affected across 6 products
🚨 CVE-2025-65291 | CVSS 7.4 HIGH Aqara Hub devices (M2, M3, Camera Hub G3) fail to validate TLS certificates, enabling MitM attacks on device control. Affected versions: • Hub M2 4.3.6_0027 • Hub M3 4.3.6_0025 • Camera Hub G3 4.1.9_0027 #CVE #Vulnerability https://t.co/625gi9jz2F
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | aqara | camera_hub_g3 | - | - | - |
| OS | aqara | camera_hub_g3_firmware | 4.1.9_0027 | - | - |
| HW | aqara | hub_m2 | - | - | - |
| OS | aqara | hub_m2_firmware | 4.3.6_0027 | - | - |
| HW | aqara | hub_m3 | - | - | - |
| OS | aqara | hub_m3_firmware | 4.3.6_0025 | - | - |