AQ
Vendor
Aqara
39
CVEs
0
On KEV
0
New 30D
Products
CH9.8
Camera Hub G3 Firmware
Aqara
8 CVEs0 on KEV0 new
HM9.8
Hub M2 Firmware
Aqara
7 CVEs0 on KEV0 new
HM9.8
Hub M3 Firmware
Aqara
7 CVEs0 on KEV0 new
IG9.8
Iam/sso Gateway
Aqara
4 CVEs0 on KEV0 new
AI9.8
Aqara IAM/SSO Gateway
Aqara
3 CVEs0 on KEV0 new
AD4.7
Aqara Developer Portal
Aqara
1 CVEs0 on KEV0 new
AD4.7
Aqara Developer Test Portal
Aqara
1 CVEs0 on KEV0 new
AI9.8
Aquara IAM/SSO Gateway
Aqara
1 CVEs0 on KEV0 new
BS9.8
Board service
Aqara
1 CVEs0 on KEV0 new
CD5.3
Cloud Developer Portal
Aqara
1 CVEs0 on KEV0 new
CO6.1
Cloud OAuth Authorization Endpoint
Aqara
1 CVEs0 on KEV0 new
CP6.5
Cloud Production API
Aqara
1 CVEs0 on KEV0 new
CO7.4
com.lumiunited.aqarahome
Aqara
1 CVEs0 on KEV0 new
DP4.7
Developer Portal
Aqara
1 CVEs0 on KEV0 new
HO7.4
Home
Aqara
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-50091 | CO com.lumiunited.aqarahome Aqara | 7.4 | Jun 12 | Aqara Home Android SDK hardcoded keys |
| CVE-2026-50090 | CO Cloud OAuth Authorization Endpoint Aqara | 6.1 | Jun 12 | Aqara OAuth redirect_uri validation bypass |
| CVE-2026-50089 | AI Aqara IAM/SSO Gateway Aqara | 6.1 | Jun 12 | Aqara IAM/SSO Gateway open redirect |
| CVE-2026-50088 | AD Aqara Developer Test Portal Aqara | 4.7 | Jun 12 | Aqara Developer Portal cross-origin resource sharing |
| CVE-2026-50087 | AI Aqara IAM/SSO Gateway Aqara | 6.1 | Jun 12 | Aqara IAM/SSO Gateway cross-origin resource sharing |
| CVE-2026-50086 | AI Aqara IAM/SSO Gateway Aqara | 9.8 | Jun 12 | Aqara unauthenticated AES oracle |
| CVE-2026-50085 | BS Board service Aqara | 9.8 | Jun 12 | Aqara Board IoT insecure debug API |
| CVE-2026-50084 | CP Cloud Production API Aqara | 6.5 | Jun 12 | Aqara API cross-account access |
| CVE-2026-50083 | AI Aquara IAM/SSO Gateway Aqara | 9.8 | Jun 12 | Aqara hardcoded OAuth client credentials |
| CVE-2026-50082 | CD Cloud Developer Portal Aqara | 5.3 | Jun 12 | Aqara Developer Portal insecure authentication token |
| CVE-2025-65297 | CH Camera Hub G3 Firmware Aqara | 7.5 | Dec 10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information |
| CVE-2025-65296 | HM Hub M3 Firmware Aqara | 6.5 | Dec 10 | NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks… |
| CVE-2025-65295 | HM Hub M3 Firmware Aqara | 8.1 | Dec 10 | Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install… |
| CVE-2025-65294 | HM Hub M2 Firmware Aqara | 9.8 | Dec 10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestricted remote command… |
| CVE-2025-65293 | CH Camera Hub G3 Firmware Aqara | 6.6 | Dec 10 | Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device… |
| CVE-2025-65292 | CH Camera Hub G3 Firmware Aqara | 7.3 | Dec 10 | Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands… |
| CVE-2025-65290 | HM Hub M3 Firmware Aqara | 7.4 | Dec 10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing… |
| CVE-2025-65291 | CH Camera Hub G3 Firmware Aqara | 7.4 | Dec 10 | Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP… |