CVE-2025-65293

6.6 mediumEPSS 2.0%

Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset.

Severity

CVSS 3.1

6.6 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-77
Published: 2025-12-10
Modified: 2026-09-25
Record from: the NVD, synced 2026-10-19

Affected

aqara:camera_hub_g3_firmware

References

https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/QR-Command-Injection.md

Check your stack JSON