CVE-2025-65291: Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS conne

CVE-2025-65291 · Severity: high · CVSS 7.4 · Published 2025-12-10

Technologies: Aqara Camera Hub G3, Aqara Hub M3, Aqara Camera Hub G3 Firmware, Aqara Hub M3 Firmware, Aqara Hub M2 Firmware, Aqara Hub M2. Vendors: Aqara.

Executive brief

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.

Affected products

Aqara camera_hub_g3
Aqara hub_m3
Aqara camera_hub_g3_firmware
Aqara hub_m3_firmware
Aqara hub_m2_firmware
Aqara hub_m2

Related threats

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted
NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devi
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechani
Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges throu