High · published December 11, 2025
⚡ A simple command injection vulnerability lurks in Aqara Hub devices, allowing attackers to run arbitrary commands with root privileges through sneaky domain names! 🔥 This is like a food critic sneaking into the kitchen and swapping out ingredients without anyone noticing — suddenly, the chef is cooking up a disaster. 🔪 Just as the kitchen relies on trust, these devices are vulnerable when they blindly trust malicious inputs. An attacker could completely compromise the affected device, executing commands that could lead to unauthorized access, manipulation of device functionalities, or even creating a backdoor for future exploits. If your home security camera is now an unwitting accomplice, that could be absolutely devastating!
This is like a food critic sneaking into the kitchen and swapping out ingredients without anyone noticing — suddenly, the chef is cooking up a disaster. 🔪 Just as the kitchen relies on trust, these devices are vulnerable when they blindly trust malicious inputs. This command injection vulnerability in Aqara Hub devices, including Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025), permits remote attackers to execute commands with root privileges simply by supplying malicious domain names.
An attacker could completely compromise the affected device, executing commands that could lead to unauthorized access, manipulation of device functionalities, or even creating a backdoor for future exploits. If your home security camera is now an unwitting accomplice, that could be absolutely devastating! It's crucial to patch your Aqara Hub devices immediately to their latest firmware versions. Ensure that you're only using trusted domain names and enforce strict input validation to avoid these sneaky attacks. Consider disabling any unnecessary services that could expose your devices to the internet. You've got this! Secure your devices today, and you'll be a true security hero! 🦸♀️🛡️
| Product | Versions | Fixed in |
|---|---|---|
| aqara/hub_m2_firmware | all versions | — |
| aqara/hub_m3_firmware | all versions | — |
| aqara/camera_hub_g3_firmware | all versions | — |