Aqara Camera Hub G3 (CH-H03)
From Wiki-IoT
Revision as of 12:24, 27 October 2026 by Jeandecian (talk | contribs)
(diff) ← Older revision | Approved revision (diff) | Latest revision (diff) | Newer revision → (diff)
| Aqara Camera Hub G3 (CH-H03) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Aqara Camera Hub G3
Brand: Aqara (Parent: Lumi United Technology) Category: Camera • Model / Gen: CH-H03 Release Date: 2022-06-01 • Status: In sale Classification Date: 2026-10-27 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | The microSD slot, reset control, and USB-C power connection are accessible; the unit is intended for indoor mounting. |
| Known vulnerabilities | Rare | 🔗 Proof | NVD documents CVE-2025-65293: command injection with root privileges through a malicious QR code during setup or factory reset. |
| Prior attacks | None | 🔗 Proof | No public model-specific botnet campaign was found. |
| Updatability | Very common | 🔗 Proof | Aqara provides product-specific support and firmware/app updates. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Full | https://www.aqara.com/en/security-certifications/ 🔗 Proof | Supports HomeKit Secure Video and certified Apple/Google/Amazon integrations; HomeKit pairing provides a strong authenticated path. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | Aqara states that camera data streams are encrypted and that WPA3 is supported. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | Supports local microSD and cloud storage; HomeKit Secure Video is end-to-end encrypted, but local microSD encryption is not documented. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | https://www.aqara.com/en/privacy-policy/ 🔗 Proof | Aqara Home account with family sharing; detailed administrator roles are not documented. |
| Authentication | Basic | https://www.aqara.com/en/privacy-policy/ 🔗 Proof | Account password login; device-specific 2FA is not documented. |
| Brute-force protection | Basic | https://www.aqara.com/en/privacy-policy/ 🔗 Proof | No public lockout/rate-limit policy; partial evidence only. |
| Event logging | Partial logging | 🔗 Proof | The app records motion/alert events and local or cloud clips; a full administrator audit log is not documented. |
| Passwords | Require change after setup with complexity requirements | https://store-support.aqara.com/products/aqara-2k-security-indoor-camera-hub-g3 🔗 Proof | Setup uses a user-created Aqara account; no shared default device password is documented. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded firmware (Companion App: Aqara Home app (Android/iOS)) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: No • Power: • Charging: No |
| Display & Camera | Display: No • Camera: |
| Sound & Connectivity | Sound: • Connectivity: 2.4 GHz Wi-Fi; Zigbee 3.0 |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
Prepared from public product documentation, vendor security information, and NVD records. The release date is approximate where the vendor did not state a day. No device was physically tested, scanned, or attacked. Each score links to the public evidence used for the assessment.
