Lannan Lisa Luo, Ph.D.

4 exploits Active since Dec 2025
CVE-2025-65290 WRITEUP HIGH WRITEUP
Aqara Hub M2, M3, and Camera Hub G3 Firmware - Improper Certificate Validation
Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downloads, allowing man-in-the-middle attackers to intercept firmware update traffic and potentially serve modified firmware files.
CVSS 7.4
CVE-2025-65291 WRITEUP HIGH WRITEUP
Aqara Hub M2, M3, and Camera Hub G3 - Improper Certificate Validation in CoAP Gateway Communications
Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discovery services and CoAP gateway communications, enabling man-in-the-middle attacks on device control and monitoring.
CVSS 7.4
CVE-2025-65292 WRITEUP HIGH WRITEUP
Aqara Hub M2/M3/Camera Hub G3 - OS Command Injection via Malicious Domain Name
Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges through malicious domain names.
CVSS 7.3
CVE-2025-65295 WRITEUP HIGH WRITEUP
Aqara Hub <4.1.9_0027-4.3.6_0025 - RCE
Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware without proper verification. The device fails to validate firmware signatures during updates, uses outdated cryptographic methods that can be exploited to forge valid signatures, and exposes information through improperly initialized memory.
CVSS 8.1