CVE Tools
Track your stack

Aqara

18 CVEs tracked since 2025. Since Dec 2025, none of them reached CISA KEV.

Aqara CVEs per month

Dec 2025 to Jun 2026. Point at a month, or focus the strip and use the arrow keys.
Aqara CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-1280
2026-01null or fewer
2026-02null or fewer
2026-03null or fewer
2026-04null or fewer
2026-05null or fewer
2026-06100

Products

The products that kept showing up in Aqara's monthly top three, with their CVEs summed over those months.

  1. Camera Hub G3 Firmware81 month
  2. Hub M2 Firmware71 month
  3. Hub M3 Firmware71 month
  4. Aqara Iam/sso Gateway31 month
  5. Cloud Developer Portal11 month
  6. Cloud Oauth Authorization Endpoint11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Aqara.

  1. CVE-2026-50091Aqara Home Android SDK hardcoded keys9.1
  2. CVE-2026-50090Aqara OAuth redirect_uri validation bypass9.3
  3. CVE-2026-50089Aqara IAM/SSO Gateway open redirect6.1
  4. CVE-2026-50088Aqara Developer Portal cross-origin resource sharing8.2
  5. CVE-2026-50087Aqara IAM/SSO Gateway cross-origin resource sharing8.2
  6. CVE-2026-50086Aqara unauthenticated AES oracle10.0
  7. CVE-2026-50085Aqara Board IoT insecure debug API8.6
  8. CVE-2026-50084Aqara API cross-account access9.6
  9. CVE-2026-50083Aqara hardcoded OAuth client credentials9.1
  10. CVE-2026-50082Aqara Developer Portal insecure authentication token6.5
  11. CVE-2025-65292Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute arbitrary commands with root privileges...7.3
  12. CVE-2025-65295Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attackers to install malicious firmware withou...8.1
  13. CVE-2025-65297Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disc...7.5
  14. CVE-2025-65296NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-service attacks through malformed JSON i...6.5
  15. CVE-2025-65293Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset.6.6

The record

Peak rank
#113 in Dec 2025
Busiest month shown
Jun 2026, 10 CVEs
Months with a KEV entry
0 since Dec 2025
Monthly snapshots
2 since 2025
Aqara's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store