Aqara Hub M3 (HM-G01E)

Security Grade

Calculator v1

   Brand: Aqara (Parent: Lumi United Technology)

   Category: Smart home hub (Zigbee 3.0 / Thread border router) • Model / Gen:  HM-G01E

   Release Date: 2024-01-01 • Status: In sale

   Classification Date: 2026-10-27 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	Very common	🔗 Proof	CVE-2025-65295: firmware images are installed without signature verification, so a modified image is accepted as legitimate.
Known vulnerabilities	Very common	[1] [2] 🔗 Proof	Three CVEs name Hub M3 firmware 4.3.6_0025 directly: root command injection via domain names (7.3), TLS certificate validation bypass on firmware download (7.4) and unsigned firmware installation (8.1).
Prior attacks	Rare	🔗 Proof	Public PoC write-ups exist, but there is no CISA KEV entry and no observed campaign against hubs.
Updatability	Rare	🔗 Proof	OTA exists and Aqara issued patched firmware, but the update channel itself was the attack surface, so updates cannot be treated as fully reliable.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The hub authenticates to the Aqara cloud account, but the local DNS and command path can be driven without credentials.
Communications	Encrypted with obselete encryption	🔗 Proof	HTTPS is used, but server certificates are not validated, so encryption provides no effective integrity against a network attacker.
Storage	Encrypted with obselete encryption	🔗 Proof	Device configuration and pairing keys are stored in flash with no documented encryption and no secure element.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	One Aqara account per home with basic sharing; no separate administrator or guest roles.
Authentication	Basic	🔗 Proof	App login is password-based with a cloud token; no MFA option and no device-level authentication for local services.
Brute-force protection	Absent	🔗 Proof	No documented lockout or rate limiting for the local interface; command injection is reachable without any authentication step.
Event logging	Absent	🔗 Proof	No access or authentication log is exposed to the user, and no syslog or export function exists.
Passwords	Require change after setup	🔗 Proof	Account password can be changed, but there is no complexity enforcement and no rotation for device-side secrets.
Category Score	Score: 3 / 3

Property	Details
Operating System & App	Linux (Aqara firmware) (Companion App: Aqara Home)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 2.4/5 GHz, Ethernet, Bluetooth LE, Zigbee 3.0, Thread
Physical (Dimensions & Mass)	Dimensions: • Mass: