CVE-2025-65297

Executive Summary

CVE-2025-65297 identifies a critical data exfiltration vulnerability in Aqara Hub devices, specifically the Camera Hub G3 (firmware 4.1.9_0027), Hub M2 (firmware 4.3.6_0027), and Hub M3 (firmware 4.3.6_0025). These devices automatically collect and upload unencrypted sensitive information without user disclosure or manufacturer consent. This flaw exposes users to potential interception of private data, including network configurations, device metadata, and possibly audio/video streams, as the data is transmitted in cleartext over the network. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The attack vector is network-based, requiring no authentication, and can be exploited by any adversary with network access to the device traffic.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in IoT devices from Aqara. The supply chain risk is high due to the lack of a patch and the automatic data collection behavior, which may violate privacy regulations.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or error. Based on the description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Sensitive data is exposed.
• Integrity (I): None (N) – Data is not modified.
• Availability (A): None (N) – Service availability is not impacted.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. The lack of encryption and automatic data collection makes this a severe privacy and security risk. An attacker on the same network can passively capture sensitive information without any interaction.

Deep Dive & Mechanics

The vulnerability stems from Aqara Hub devices transmitting sensitive data over the network in plaintext (unencrypted). The data collection is automatic and occurs without user consent or disclosure. The exact data being collected is not fully specified, but likely includes:

• Device configuration and network credentials.
• User activity logs and sensor data.
• Potentially audio/video streams from the Camera Hub G3.
• Firmware update requests and responses.

The attack vector is passive network sniffing. An attacker with access to the local network (e.g., via a compromised device, rogue access point, or ARP spoofing) can capture packets from the Aqara Hub. Since the data is unencrypted, the attacker can read all transmitted information. This is a classic case of Cleartext Transmission of Sensitive Information (CWE-319).

The devices likely communicate with Aqara cloud servers using HTTP or other unencrypted protocols. The automatic collection suggests a background process that periodically sends telemetry or status updates without user knowledge.

Vulnerable vs. Patched Code

No patch is currently available. The vulnerable firmware versions are:

• Camera Hub G3: 4.1.9_0027
• Hub M2: 4.3.6_0027
• Hub M3: 4.3.6_0025

A patched version would need to implement TLS/SSL encryption for all outbound communications, provide user consent mechanisms, and allow users to disable telemetry. Since no patch exists, there is no code diff to analyze.

Exploitation & Lab Setup

Red Team

Objective: Capture unencrypted sensitive data from an Aqara Hub on the local network.

Lab Setup:

1. Hardware: Aqara Hub (any affected model), a computer with Wireshark or tcpdump, and a network switch or hub (or use ARP spoofing).
2. Network: Ensure the Aqara Hub and attacker machine are on the same subnet.
3. Tools: Wireshark, tcpdump, or a custom Python script using scapy.

Steps:

1. Start packet capture on the attacker machine:

   sudo tcpdump -i eth0 -w aqara_capture.pcap
   

2. Power on the Aqara Hub and allow it to connect to the network.
3. Wait for the device to automatically send data (this may occur periodically).
4. Stop the capture after a few minutes.
5. Analyze the pcap file for unencrypted HTTP requests or other plaintext protocols:

   tshark -r aqara_capture.pcap -Y "http.request or http.response" -T fields -e http.host -e http.request.uri -e http.file_data
   

6. Look for sensitive data such as device IDs, network SSIDs, passwords, or sensor readings.

Expected Results: The attacker will see plaintext data containing device information, possibly including credentials or user activity.

Blue Team

Objective: Detect and prevent exploitation of this vulnerability.

Detection:

• Monitor for unencrypted outbound traffic from Aqara Hub IPs on ports 80 (HTTP) or other non-standard ports.
• Use network intrusion detection systems (NIDS) to flag cleartext transmission of sensitive keywords (e.g., "password", "token", "ssid").

Prevention:

• Segment IoT devices on a separate VLAN with strict egress filtering.
• Use a VPN or proxy to force encryption for all outbound traffic from IoT devices.
• Disable automatic updates and telemetry if possible (check device settings).
• Monitor for firmware updates from Aqara and apply patches immediately when available.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Unencrypted HTTP requests from Aqara Hub IP addresses to known Aqara cloud domains (e.g., *.aqara.com).
  • Plaintext data containing strings like "device_id", "ssid", "password", "token", or "sensor_data".
• Device Behavior:
  • Periodic outbound connections to external servers without user interaction.
  • High data usage from the hub during idle periods.
• Firmware Versions:
  • Camera Hub G3: 4.1.9_0027
  • Hub M2: 4.3.6_0027
  • Hub M3: 4.3.6_0025

Detection Engineering

YARA Rule

rule Aqara_Unencrypted_Data_Exfiltration {
    meta:
        description = "Detects unencrypted sensitive data from Aqara Hub devices"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65297"
    strings:
        $s1 = "device_id" ascii wide nocase
        $s2 = "ssid" ascii wide nocase
        $s3 = "password" ascii wide nocase
        $s4 = "token" ascii wide nocase
        $s5 = "sensor_data" ascii wide nocase
        $s6 = "aqara" ascii wide nocase
    condition:
        any of ($s*) and #s6 > 0
}

Sigma Rule

title: Aqara Hub Unencrypted Data Exfiltration
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects unencrypted HTTP traffic from Aqara Hub devices containing sensitive data
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-65297
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image: '*'
        DestinationPort: 80
        DestinationIp: '*'
        Protocol: 'tcp'
        Payload|contains:
            - 'device_id'
            - 'ssid'
            - 'password'
            - 'token'
            - 'sensor_data'
            - 'aqara'
    condition: selection
falsepositives:
    - Legitimate Aqara cloud communication (if encrypted, this rule will not trigger)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Aqara Hub Unencrypted Data Exfiltration"; flow:to_server; content:"device_id"; nocase; content:"ssid"; nocase; content:"password"; nocase; content:"token"; nocase; content:"sensor_data"; nocase; content:"aqara"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Aqara Hubs: Place all affected devices on a separate VLAN with no direct internet access. Use a firewall to block outbound traffic to unknown destinations.
2. Monitor Network Traffic: Use the provided detection rules to identify any ongoing data exfiltration.
3. Disable Telemetry: If the device settings allow, disable automatic data collection and updates.
4. Contact Aqara: Demand a firmware patch that encrypts all outbound communications and provides user consent options.

Long-Term Fix:

• Aqara must release a firmware update that implements TLS/SSL for all communications, removes automatic data collection, and adds a privacy policy with opt-in consent.
• Users should replace affected devices with alternatives that respect privacy and use encryption by default.

Valters IT