Vulnerabilidades do Aqara Hub M2 Firmware
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Aqara Hub M2 Firmware: 7 registro(s), com versões afetadas e correções.cpe:2.3:o:aqara:hub_m2_firmware
CVE-2025-65297
Alta · 7.5
CWE-5 10/12/2025
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3…
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.
CVE-2025-65296
Média · 6.5
CWE-476 10/12/2025
NULL Pointer Dereference em Aqara Hub M2 Firmware
NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs.
CVE-2025-65295
Alta · 8.1
CWE-326 10/12/2025
Inadequate Encryption Strength em Aqara Hub M2 Firmware
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
CVE-2025-65294
Crítica · 9.8
CWE-94 10/12/2025
Code Injection em Aqara Hub M2 Firmware
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
CVE-2025-65292
Alta · 7.3
CWE-77 10/12/2025
Command Injection em Aqara Hub M2 Firmware
Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.
CVE-2025-65291
Alta · 7.4
CWE-295 10/12/2025
Improper Certificate Validation em Aqara Hub M2 Firmware
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
CVE-2025-65290
Alta · 7.4
CWE-295 10/12/2025
Improper Certificate Validation em Aqara Hub M2 Firmware
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files.