Cyber Resilience

CVE-2025-65297

Aqara Hub M2 Firmware 4.3.6_0027

Published
10 December 2025
Modified
19 December 2025
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0019 9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-65297 is a high-severity J2EE Misconfiguration: Data Transmission Without Encryption (CWE-5) vulnerability in Aqara Hub M2 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A02:2025 Security Misconfiguration

EU & UK References

Vulnerability Data

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer.

CWE(s)
CWE-5

Related Threats

MITRE ATT&CK Enterprise Techniques

T1040 Network Sniffing Credential Access
Adversaries may passively sniff network traffic to capture information about an environment, including authentication material passed over the network.
attack.mitre.org →
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-65291Same product: Aqara Camera Hub G3
CVE-2025-65290Same product: Aqara Camera Hub G3
CVE-2025-65295Same product: Aqara Camera Hub G3
CVE-2025-65294Same product: Aqara Camera Hub G3
CVE-2025-65296Same product: Aqara Camera Hub G3
CVE-2025-65292Same product: Aqara Camera Hub G3
CVE-2026-50086Same vendor: Aqara
CVE-2025-65293Same product: Aqara Camera Hub G3
CVE-2025-52435Shared CWE-5
CVE-2026-50087Same vendor: Aqara

Affected Assets

aqara
hub m2 firmware
4.3.6_0027
aqara
hub m3 firmware
4.3.6_0025
aqara
camera hub g3 firmware
4.1.9_0027

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-13 Cryptographic Protection good match

SC-13 mandates use of cryptography, which is the mechanism needed to avoid unencrypted transmission.

SC-8 Transmission Confidentiality and Integrity good match

SC-8 directly requires protection of confidentiality and integrity for transmitted information, structurally preventing plaintext transmission.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-02 full match
prevents

Directly requires encryption and related protections for all data-in-transit, preventing the exact misconfiguration described.

PR.PS-01 mostly match
prevents

Configuration management practices would normally enforce encrypted transit settings, but the control addresses many other settings beyond this weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography full match
prevents

Directly requires use of cryptography to protect data confidentiality and integrity during transmission.

A.8.20 Networks security mostly match
prevents

Mandates network security controls including encryption of traffic to prevent interception.

A.5.14 Information transfer partial match
prevents

Requires secure transfer procedures that would mandate encryption for sensitive data in transit.

A.8.21 Security of network services partial match
prevents

Requires security measures for network services, which include encryption of transmitted data.

A.8.26 Application security requirements partial match
prevents

Application security requirements may specify encryption for data in transit as a functional requirement.

References