# CVE-2025-65293: Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with…

Source: https://junglewise.ai/threats/cve-2025-65293-command-injection-vulnerabilities-in-aqara-camera-hub-g3-4-1-9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10  
License: CC BY 4.0 with a link back

CVE-2025-65293 · Severity: medium · CVSS 6.6 · Published 2025-12-10

Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset.

Technologies: [Aqara Camera Hub G3](https://junglewise.ai/threats/technologies/camera-hub-g3), [Aqara Camera Hub G3 Firmware](https://junglewise.ai/threats/technologies/camera-hub-g3-firmware). Vendors: [Aqara](https://junglewise.ai/threats/vendors/aqara).

## Quick answers

**Is CVE-2025-65293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65293 being exploited in the wild.

**How severe is CVE-2025-65293?** Medium severity, with a CVSS score of 6.6, published 10 December 2025.

**Which products and versions are affected?** Aqara Camera Hub G3, Aqara Camera Hub G3 Firmware. The advisory does not name versions.

**Is there a fix for CVE-2025-65293?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-65293?** Check whether you run Aqara Camera Hub G3 or Aqara Camera Hub G3 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Aqara Camera Hub G3
- Aqara Camera Hub G3 Firmware

## Related threats

- [Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect…](https://junglewise.ai/threats/cve-2025-65297-aqara-hub-devices-including-camera-hub-g3-4-1-9-0027-hub-m2-4-3-6)
- [NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027…](https://junglewise.ai/threats/cve-2025-65296-null-pointer-dereference-vulnerabilities-in-aqara-hub-m2-4-3-6)
- [Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and…](https://junglewise.ai/threats/cve-2025-65295-multiple-vulnerabilities-in-aqara-hub-firmware-update-process-in)
- [Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented…](https://junglewise.ai/threats/cve-2025-65294-aqara-hub-devices-including-camera-hub-g3-4-1-9-0027-hub-m2-4-3-6)
- [Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3…](https://junglewise.ai/threats/cve-2025-65292-command-injection-vulnerability-in-aqara-hub-devices-including)