Executive brief
The Aqara Board service, a component of the Aqara smart home platform, contains a security flaw that allows unauthorized commands to be sent to the platform's message broker. This vulnerability enables an attacker to bypass security controls and potentially interact with smart home devices like locks, cameras, and hubs. When used in combination with other identified flaws, this could lead to a complete remote takeover of customer devices without any user interaction.
Technical details
The Aqara Board service (op-test.aqara.com) suffers from a missing authentication vulnerability (CWE-306) in its debug and configuration endpoints. Specifically, the 'POST /board/downstream/api/debug' and '/board/downstream/panel/config/down' endpoints accept arbitrary MQTT command payloads and forward them to the internal HiveMQ broker (172.16.201.20) without verifying the requester's identity. Additionally, the service exposes a WebSocket at '/board/ws' with unauthenticated access enabled. An attacker can leverage these endpoints to inject commands into the IoT management plane. When chained with CVE-2026-50082, CVE-2026-50083, and CVE-2026-50084, this allows for full unauthenticated remote takeover of smart locks, cameras, and hubs. The vendor reportedly mitigated the issue in April 2026.
Affected products
- Aqara Board service op-test.aqara.com
Timeline
- 2026-03-13: disclosed: Researcher discovered issues and initiated vendor outreach.
- 2026-03-30: patched: Researcher confirmed mitigation by vendor.
- 2026-04-20: advisory: Vendor acknowledged reporting and stated the issue was fixed.
- 2026-06-12: disclosed: Public disclosure of CVE-2026-50085.