CVE-2025-65296: NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing

CVE-2025-65296 · Severity: medium · CVSS 6.5 · Published 2025-12-10

Technologies: Aqara Camera Hub G3, Aqara Hub M3, Aqara Camera Hub G3 Firmware, Aqara Hub M3 Firmware, Aqara Hub M2 Firmware, Aqara Hub M2. Vendors: Aqara.

Executive brief

NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs.

Affected products

Aqara camera_hub_g3
Aqara hub_m3
Aqara camera_hub_g3_firmware
Aqara hub_m3_firmware
Aqara hub_m2_firmware
Aqara hub_m2

Related threats

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devi
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechani
Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges throu
Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows att