High · published December 11, 2025
🚨 It’s alarmingly easy for attackers to slip in modified firmware with the Aqara Hub devices! This is like a hotel that doesn’t verify your ID upon check-in, allowing anyone to check into your room and change the amenities without you knowing! If an attacker successfully intercepts the firmware update traffic, they could install malicious firmware, potentially spying on you through your camera or turning your hub into a gateway for further attacks. The implications could be devastating for your privacy and security!
This is like a hotel that doesn’t verify your ID upon check-in, allowing anyone to check into your room and change the amenities without you knowing! The vulnerability arises from Aqara Hub devices failing to validate server certificates during HTTPS firmware downloads, enabling man-in-the-middle attacks to intercept or alter firmware updates without detection.
If an attacker successfully intercepts the firmware update traffic, they could install malicious firmware, potentially spying on you through your camera or turning your hub into a gateway for further attacks. The implications could be devastating for your privacy and security! To protect yourself, ensure your devices are set to only accept firmware updates from verified sources. Regularly check for updates manually and monitor your devices for any unexpected behavior. Consider contacting Aqara for additional security guidance. You’ve got this! Stay vigilant and secure your home with these simple steps! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| aqara/hub_m2_firmware | all versions | — |
| aqara/hub_m3_firmware | all versions | — |
| aqara/camera_hub_g3_firmware | all versions | — |