High · published December 11, 2025
⚡ A TLS certificate validation flaw in Aqara Hub devices means attackers can slip into your connections like a stealthy ninja! 🥷 Think of it like a hotel that lets guests in without checking their ID — anyone can waltz in and impersonate a staff member, messing with your reservations and your peace of mind. An attacker could intercept and manipulate communications between your devices, potentially taking control of your smart home setup or spying on your activities. This could lead to unauthorized access to sensitive information or the ability to control devices without your consent, making it a serious security risk.
Think of it like a hotel that lets guests in without checking their ID — anyone can waltz in and impersonate a staff member, messing with your reservations and your peace of mind. Aqara Hub devices, including Hub M2 (version 4.3.6_0027) and Hub M3 (version 4.3.6_0025), fail to validate server certificates in TLS connections used for discovery services and CoAP gateway communications, enabling potential man-in-the-middle attacks.
An attacker could intercept and manipulate communications between your devices, potentially taking control of your smart home setup or spying on your activities. This could lead to unauthorized access to sensitive information or the ability to control devices without your consent, making it a serious security risk. Update your Aqara Hub devices to the latest firmware versions to ensure proper certificate validation. Additionally, regularly monitor device settings and network traffic to spot any anomalies. 🚀 You’ve got this! Stay proactive and keep your smart home safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| aqara/hub_m2_firmware | all versions | — |
| aqara/hub_m3_firmware | all versions | — |
| aqara/camera_hub_g3_firmware | all versions | — |