CVE Intelligence
Analysis AI-assisted

CVE-2026-50085: Aqara Board Service: missing authentication on MQTT debug API

The Aqara Board Service accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. NVD scores the issue 9.8 (Critical), while runZero estimates 8.6 (High). No fixed version is listed, and CISA KEV does not list this CVE.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The Aqara Board Service, reachable at op-test.aqara.com, accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. The weakness is classified as CWE-306, missing authentication for a critical function. According to the record, combined with CVE-2026-50082, CVE-50083 and CVE-50084, it can lead to a fully unauthenticated remote takeover of affected devices.

Impact

  • Parties with network access to the service may be able to send commands through the broker path without credentials.
  • The record states that the combination with the other CVEs can lead to remote takeover of affected devices. This is the description's claim and was not independently verified here.
  • Severity is inconsistent across sources: NVD lists a score of 9.8 (Critical), while runZero and another provider list 8.6 (High).

Affected products and versions

  • Product: Aqara Board Service.
  • Versions listed in the record: 2026-04-20 and later.
  • No fixed version is listed in the sources consulted.

Exploitation status

CVE-2026-50085 is not listed in the CISA Known Exploited Vulnerabilities catalog, so no active exploitation is recorded there. The SSVC data in the record marks exploitation as proof of concept, and one third-party reference is tagged as exploit-related. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Identify Aqara Board Service deployments at version 2026-04-20 or later and request an updated build or guidance from the vendor, since no fixed version is listed.
  • Restrict network access to the service and its MQTT path to trusted administrative networks only.
  • Prioritize review of devices reachable from untrusted networks, given the automatable SSVC value and the proof-of-concept status.
  • Follow the runZero advisory for updates.

Detection guidance

  • Review broker and gateway logs for MQTT messages originating from unexpected clients or network segments.
  • Alert on command traffic directed at devices from sources that are not known management systems.

Limitations of the available information

  • No fixed version, patch or vendor advisory is listed in the record.
  • CVSS scores differ between sources (9.8 from NVD, 8.6 from runZero and another provider).
  • The description refers to CVE-2026-50082, CVE-50083 and CVE-50084, whose details are not part of this record.
  • The affected version range comes only from the record, and its completeness is unknown.

Frequently asked questions

Is CVE-2026-50085 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record marks exploitation as proof of concept.

Which Aqara Board Service versions are affected?

The record lists versions 2026-04-20 and later. No fixed version is listed, so contact the vendor for an updated build or guidance.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.