CVE-2025-65297

Technical Details

The vulnerability, CVE-2025-65297, stems from the Aqara Hub devices' inherent behavior of automatically collecting and transmitting sensitive user data without proper encryption or user consent. The affected devices, including the Camera Hub G3, Hub M2, and Hub M3, are programmed to gather information and upload it to remote servers. The critical flaw lies in the fact that this data is transmitted in an unencrypted format, making it vulnerable to interception and unauthorized access by malicious actors. This could include personally identifiable information (PII), device configuration data, and potentially even audio/video recordings depending on the device's capabilities and the specific data being collected. The lack of disclosure or consent further exacerbates the issue, as users are unaware that their data is being collected and transmitted in this manner, hindering their ability to take proactive measures to protect their privacy.

The automatic nature of the data collection and upload process means that the vulnerability is constantly active, posing a persistent threat to users. An attacker positioned on the same network as the Aqara Hub device, or one who has compromised the device itself, could potentially intercept the unencrypted data stream and gain access to sensitive information. The vulnerability is particularly concerning given the increasing prevalence of IoT devices in homes and businesses, and the growing awareness of the privacy risks associated with these devices.