Hub M3 Firmware
Approved changes feed: RSS · Atom
cpe:2.3:o:aqara:hub_m3_firmware:4.3.6_0025:*:*:*:*:*:*:*
part: o version: 4.3.6_0025 update: *
| Vendor | Aqara (18e70550-0f8b-519b-84bc-a99d39d92475) |
|---|---|
| Product | Hub M3 Firmware (41536f61-cc84-5d44-8bd3-e92d0f5194c5) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-65297 |
vulnerable | 2026-06-08 07:39:20.830447 |
Details available
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.
Published: 2025-12-10T00:00:00.000Z
Updated: 2025-12-11T15:09:53.533Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65296 |
vulnerable | 2026-06-08 07:39:20.829800 |
Details available
NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON inputs.
Published: 2025-12-10T00:00:00.000Z
Updated: 2025-12-11T15:24:39.046Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65295 |
vulnerable | 2026-06-08 07:39:20.829074 |
Details available
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
Published: 2025-12-10T00:00:00.000Z
Updated: 2025-12-11T20:41:30.850Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65294 |
vulnerable | 2026-06-08 07:39:20.828593 |
Details available
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command execution.
Published: 2025-12-10T00:00:00.000Z
Updated: 2025-12-11T15:39:29.906Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65292 |
vulnerable | 2026-06-08 07:39:20.827480 |
Details available
Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.
Published: 2025-12-10T00:00:00.000Z
Updated: 2025-12-11T16:44:54.467Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65291 |
vulnerable | 2026-06-08 07:39:20.826964 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65290 |
vulnerable | 2026-06-08 07:39:20.818812 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.