(diff) โ Older revision | Latest revision (diff) | Newer revision โ (diff)
| Aqara Hub M2 (HM2-G01)
|
|
Security Grade
Calculator v
|
Aqara Hub M2
Release Date: 2021-09-27 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
๐ Proof
|
Aqara says its devices use a tamper-resistant secure element; no hardware attacks found in my search
|
| Known vulnerabilities
|
Rare
|
๐ Proof
|
8 CVEs disclosed Dec 2025 (CVE-2025-65290 to 65297) incl. unauthenticated RCE (CVE-2025-65294) and unsigned firmware updates (CVE-2025-65295).
|
| Prior attacks
|
Rare
|
๐ Proof
|
A public exploit reference exists (Exploit-DB), but CISA's assessment lists exploitation as none; no in-the-wild attacks found.
|
| Updatability
|
None
|
๐ Proof
|
OTA updates exist (V4.3.8, Aug 2025), but the update process itself is insecure, and no public advisories for these CVEs were found as of May 2026.
|
| Category Score
|
Score: 3 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
๐ Proof
|
Hub fails to validate server certificates for firmware downloads and TLS discovery/CoAP connections (CVE-2025-65290, 65291).
|
| Communications
|
Encrypted with obselete encryption
|
๐ Proof
|
TLS is used but certificates are not validated, and some data is uploaded unencrypted (CVE-2025-65297).
|
| Storage
|
Encrypted with obselete encryption
|
๐ Proof
|
Vendor states a secure element encrypts sensitive data such as passwords and keys (vendor claim, not independently verified).
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
๐ Proof
|
๏ผManaged through the Aqara account and app, with account security settings.
|
| Authentication
|
Secure
|
๐ Proof
|
Aqara offers optional two-factor authentication (authenticator app).
|
| Brute-force protection
|
Basic
|
๐ Proof
|
A third-party guide reports account lockout after repeated failed logins; not confirmed in Aqara documentation.
|
| Event logging
|
Partial logging
|
โ
|
Third-party guides mention login history and access logs in the app; not confirmed in official documentation.
|
| Passwords
|
Require change after setup
|
๐ Proof
|
No default device password found; users sign in with their own Aqara account password.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: Aqara Home)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: 5 V, 1 A or 2 A (micro-USB) • Charging: N/A
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Wi-Fi 802.11b/g/n 2.4 GHz, Zigbee 3.0, Bluetooth LE 5.0, Ethernet RJ-45, 360ยฐ infrared
|
| Physical (Dimensions & Mass)
|
Dimensions: ฯ100.5 ร 30.75 mm • Mass:
|
The Aqara Hub M2 is a multi-protocol smart home hub. Eight CVEs were disclosed in Dec 2025, including unauthenticated remote code execution and firmware updates without signature verification. Aqara shipped OTA updates, but no public security advisories were found. Positives include optional two-factor authentication and a secure element for key storage.
