CVE-2025-65297: hub m2 (CVSS 7.5)

Description

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.

Is your site exposed to CVE-2025-65297?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-5 CWE-5

Affected Products

Vendor	Product	Versions
aqara	hub_m2_firmware	All
aqara	hub_m2	All
aqara	hub_m3_firmware	All
aqara	hub_m3	All
aqara	camera_hub_g3_firmware	All
aqara	camera_hub_g3	All

References

Other References

https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Unauthorized-Data-Upload.md

Frequently Asked Questions

What is CVE-2025-65297? +

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2025-65297? +

CVE-2025-65297 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-65297? +

CVE-2025-65297 affects products from aqara, specifically: camera_hub_g3, camera_hub_g3_firmware, hub_m2, hub_m2_firmware, hub_m3, hub_m3_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-65297? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-65294 9.8

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access …

CVE-2025-65295 8.1

Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 …

CVE-2025-65291 7.4

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in …

CVE-2025-65290 7.4

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates …

CVE-2025-65292 7.3

Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows …

CVE-2025-65293 6.6

Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious …

CVE-2025-65297