CVE-2025-65294: Aqara Hub M2 Firmware RCE Vulnerability

CVE-2025-65294 Overview

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution. This firmware vulnerability affects multiple smart home hub devices manufactured by Aqara, exposing them to complete system compromise through network-accessible attack vectors.

Critical Impact

Attackers can achieve complete device compromise with unrestricted remote command execution capabilities, potentially gaining control over connected smart home ecosystems and accessing sensitive network resources.

Affected Products

• Aqara Camera Hub G3 (Firmware version 4.1.9_0027)
• Aqara Hub M2 (Firmware version 4.3.6_0027)
• Aqara Hub M3 (Firmware version 4.3.6_0025)

Discovery Timeline

• 2025-12-10 - CVE-2025-65294 published to NVD
• 2025-12-17 - Last updated in NVD database

Technical Details for CVE-2025-65294

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The affected Aqara Hub devices contain an undocumented remote access mechanism that was likely implemented for development or debugging purposes but was not properly secured or removed before production deployment.

The vulnerability requires no authentication or user interaction to exploit and can be triggered remotely over the network. An attacker with network access to the vulnerable device can leverage this undocumented mechanism to execute arbitrary commands with the privileges of the hub's operating system. Given that IoT hub devices typically run with elevated privileges to control connected smart home devices, successful exploitation grants attackers significant control over the target environment.

Root Cause

The root cause of this vulnerability is the presence of an undocumented remote execution mechanism in the firmware of affected Aqara Hub devices. This type of functionality is sometimes referred to as a "backdoor" when it provides unauthorized access capabilities. The mechanism lacks proper access controls and authentication, allowing any network-connected attacker to leverage it for malicious purposes.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker must have network connectivity to the affected Aqara Hub device, which could be achieved through:

• Direct access to the local network where the hub is deployed
• Compromising another device on the same network segment
• Exploiting network misconfigurations that expose the hub to the internet

Once network access is established, the attacker can interact with the undocumented remote access mechanism to execute arbitrary commands on the target device. The unrestricted nature of this execution capability means attackers can install persistent malware, exfiltrate data, pivot to other network resources, or manipulate connected smart home devices.

For detailed technical analysis of the vulnerability mechanism, refer to the Undocumented Remote Execution Report published by the researcher.

Detection Methods for CVE-2025-65294

Indicators of Compromise

• Unexpected outbound network connections from Aqara Hub devices to unknown external IP addresses
• Unusual process execution or system commands running on the hub device
• Modifications to firmware files or configuration settings that were not initiated by administrators
• Anomalous network traffic patterns on ports associated with the undocumented remote access mechanism

Detection Strategies

• Monitor network traffic to and from Aqara Hub devices for suspicious command-and-control patterns
• Implement network segmentation to isolate IoT devices and detect lateral movement attempts
• Deploy network intrusion detection systems (NIDS) with signatures for known IoT exploitation techniques
• Audit firmware versions across all Aqara devices to identify those running vulnerable versions

Monitoring Recommendations

• Enable logging on network devices to capture all traffic involving Aqara Hub IP addresses
• Establish baseline behavior profiles for IoT devices and alert on deviations
• Monitor for reconnaissance activity targeting common IoT ports and services
• Review connected device behavior for signs of unauthorized manipulation or configuration changes

How to Mitigate CVE-2025-65294

Immediate Actions Required

• Isolate affected Aqara Hub devices on a separate network segment with strict firewall rules
• Block inbound network access to Aqara Hub devices from untrusted networks
• Monitor vendor communications for security patch announcements
• Audit network logs for any indicators of prior exploitation attempts

Patch Information

At the time of publication, no vendor security patches have been confirmed. Organizations should monitor the QR Command Injection Report and Undocumented Remote Execution Report for updates and check Aqara's official channels for firmware updates addressing this vulnerability.

Workarounds

• Place Aqara Hub devices on an isolated IoT VLAN with no direct internet access
• Implement firewall rules to restrict network access to the hub devices to only necessary management interfaces
• Consider disabling or physically disconnecting affected devices if they are not critical to operations
• Use network access control (NAC) to limit which devices can communicate with the vulnerable hubs

# Example firewall rule to isolate IoT devices (iptables)
# Block all inbound traffic to Aqara Hub except from trusted management IP
iptables -A INPUT -d <AQARA_HUB_IP> -s <TRUSTED_MGMT_IP> -j ACCEPT
iptables -A INPUT -d <AQARA_HUB_IP> -j DROP

# Block outbound traffic from Aqara Hub to internet
iptables -A OUTPUT -s <AQARA_HUB_IP> -d <LOCAL_NETWORK> -j ACCEPT
iptables -A OUTPUT -s <AQARA_HUB_IP> -j DROP