CVE-2026-50091 Overview
CVE-2026-50091 affects the Aqara Home Android application (com.lumiunited.aqarahome) version 6.0.0 and white-label clients that embed the same liblumidevsdk.so native library. The vulnerability stems from the use of hard-coded cryptographic keys inside the shared SDK, classified as [CWE-321: Use of Hard-coded Cryptographic Key]. Any attacker who extracts the embedded keys from the publicly available APK can decrypt, forge, or tamper with protected data exchanged by the SDK. The flaw is network-exploitable without authentication or user interaction.
Critical Impact
Hard-coded keys inside liblumidevsdk.so allow remote attackers to break confidentiality and integrity of communications across every app embedding the SDK.
Affected Products
- Aqara Home Android (com.lumiunited.aqarahome) version 6.0.0
- White-label Android clients embedding liblumidevsdk.so
- Downstream smart-home integrations built on the Lumi/Aqara SDK
Discovery Timeline
- 2026-06-12 - CVE-2026-50091 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-50091
Vulnerability Analysis
The vulnerability lives in the native library liblumidevsdk.so, which the Aqara Home Android application and several white-label clients load at runtime. The SDK ships with cryptographic key material compiled directly into the binary. Because the same APK and shared object are distributed to every user, the keys are identical across installations.
An attacker can download the APK, extract liblumidevsdk.so, and recover the keys through static analysis. Once recovered, the keys enable decryption of intercepted traffic, forgery of signed payloads, and impersonation of legitimate clients or services that rely on the SDK for transport or message-level protection.
Root Cause
The root cause is the storage of long-lived symmetric or asymmetric key material as constants inside a shipped native library. The application performs no key derivation, no per-device provisioning, and no remote key rotation, so compromise of one binary compromises the entire fleet.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker positioned on the network path, or one able to relay traffic to Aqara endpoints, can use the extracted keys to decrypt sessions, replay commands, or inject malicious messages. The PoC repository published on GitHub demonstrates key recovery and protocol abuse against the SDK. See the GitHub PoC Repository and the RunZero Security Advisory for technical details.
Detection Methods for CVE-2026-50091
Indicators of Compromise
- Outbound traffic from Android devices to Aqara cloud endpoints carrying payloads that decrypt under the published static keys.
- Presence of liblumidevsdk.so in installed APKs with the unpatched 6.0.0 SDK fingerprint.
- Anomalous device-control commands originating from clients that were never paired through the legitimate provisioning flow.
Detection Strategies
- Inventory mobile and IoT assets to identify the com.lumiunited.aqarahome package and white-label clients embedding liblumidevsdk.so.
- Inspect network captures for sessions that can be decrypted with the keys disclosed in the public PoC, indicating exposure of affected SDK builds.
- Monitor cloud-side logs for command sequences that do not correlate with legitimate app sessions or for replayed message identifiers.
Monitoring Recommendations
- Alert on unexpected geographic or ASN origins for Aqara cloud API calls tied to a given account.
- Track APK versions in mobile device management (MDM) inventories and flag installations of 6.0.0 or earlier embedding the vulnerable SDK.
- Capture and review TLS metadata to identify clients using legacy SDK fingerprints on the wire.
How to Mitigate CVE-2026-50091
Immediate Actions Required
- Update Aqara Home and any white-label client to a release that removes hard-coded keys from liblumidevsdk.so once the vendor publishes a fix.
- Segment smart-home devices onto an isolated VLAN to limit the impact of forged or replayed commands.
- Rotate any account credentials, tokens, or shared secrets that may have traversed the SDK under the compromised keys.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Track the RunZero Security Advisory for vendor remediation status and updated SDK builds.
Workarounds
- Restrict affected mobile apps from untrusted networks and require VPN access to home networks when controlling Aqara devices remotely.
- Disable remote-access features of the Aqara Home app where business or personal use does not require them.
- Remove white-label clients embedding the vulnerable SDK from managed device fleets until a fixed build is available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
