CVE-2025-65290 Details
Description
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files.
A vulnerability exists in Aqara Hub devices, including the Camera Hub G3, Hub M2, and Hub M3, all of which fail to properly validate server certificates during HTTPS firmware downloads. This oversight allows man-in-the-middle attackers to intercept firmware update traffic and potentially deliver modified firmware. The issue arises because the firmware download process establishes a TLS connection without requesting certificate verification, leaving the devices susceptible to accepting any certificate, regardless of its validity or whether it matches the expected hostname.
Users can update to Aqara Hub M2 and M3 firmware version 4.3.8, released on August 28, 2025, or to the Camera Hub G3 fixed version released on October 20, 2025.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Dec 11, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/OTA-Certificate-Validation-Bypass.md | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| aqara hub m2 firmware | 4.3.6_0027 |
CPE
Remediation
| |
| aqara hub m2 | All versions |
CPE
Remediation
| |
| aqara hub m3 firmware | 4.3.6_0025 |
CPE
Remediation
| |
| aqara hub m3 | All versions |
CPE
Remediation
| |
| aqara camera hub g3 firmware | 4.1.9_0027 |
CPE
Remediation
| |
| aqara camera hub g3 | All versions |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 17, 2025 | Initial Analysis | [email protected] |
| Dec 11, 2025 | CVE Modified | CISA-ADP |
| Dec 10, 2025 | New CVE Received | [email protected] |