Critical · published December 11, 2025
🚨 A sneaky remote access mechanism is hiding in select Aqara Hub devices! 🔥 Think of it like a hotel with a backdoor that staff can use to access any room without a key — once in, they can do anything they want, from snooping on guests to changing bookings. This is exactly what's happening with the affected Aqara Hub devices, where attackers can execute commands without any restrictions. An attacker could gain unrestricted access to your smart home, allowing them to control devices, view camera feeds, or manipulate settings. This could lead to privacy violations, unauthorized surveillance, and a complete takeover of your smart home environment — absolutely devastating!
Think of it like a hotel with a backdoor that staff can use to access any room without a key — once in, they can do anything they want, from snooping on guests to changing bookings. This is exactly what's happening with the affected Aqara Hub devices, where attackers can execute commands without any restrictions. These Aqara Hub devices contain an undocumented remote access feature that allows for unrestricted remote command execution, meaning an attacker can send arbitrary commands to the device without authentication.
An attacker could gain unrestricted access to your smart home, allowing them to control devices, view camera feeds, or manipulate settings. This could lead to privacy violations, unauthorized surveillance, and a complete takeover of your smart home environment — absolutely devastating! Immediately update all affected devices to the latest firmware versions: Camera Hub G3 (4.1.9_0028), Hub M2 (4.3.6_0028), and Hub M3 (4.3.6_0026). Regularly check for updates and consider disabling remote access if it's not needed. 🛡️ You’ve got this! By taking these steps, you’ll lock down your smart home and keep it safe. 🔒✨
| Product | Versions | Fixed in |
|---|---|---|
| aqara/hub_m2_firmware | all versions | — |
| aqara/hub_m3_firmware | all versions | — |
| aqara/camera_hub_g3_firmware | all versions | — |