| Aqara Hub M2
|
|
Security Grade
Calculator v1
|
Aqara Hub M2
Release Date: 2020-08-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Published M2 issues are remote or adjacent-network command injection (CVE-2025-65292); no mass physical-tampering case was found.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
A 2025 cluster names Hub M2 firmware 4.3.6_0027 directly: undocumented remote access (CVE-2025-65294, CVSS 9.8), command injection, missing server-certificate validation and an unsigned/weak firmware-update path (CVE-2025-65295).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No Aqara product is listed in CISA KEV and no public in-the-wild exploitation of the M2 cluster was identified.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware is updated over the air from the Aqara Home app, though the update process itself was found to lack integrity enforcement (CVE-2025-65295).
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
Hub exposes child devices to Apple HomeKit, Alexa, Google Assistant and Matter-style ecosystems with per-ecosystem pairing.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Cloud traffic is TLS-based but Hub M2 firmware failed to validate server certificates (CVE-2025-65290/65291), which downgrades the effective transport protection.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
Keys are held in onboard flash with legacy protection, and the hub was found collecting and uploading data without adequate disclosure (CVE-2025-65297).
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Aqara Home account with region-scoped homes and member sharing; role granularity and recovery controls are limited.
|
| Authentication
|
Basic
|
🔗 Proof
|
Password-based app login and local pairing; the undocumented remote access path in CVE-2025-65294 shows authentication is not uniformly enforced.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Cloud login has basic rate limiting; local interfaces have no documented lockout policy.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app shows device/automation history and alarms; authentication events are not exposed as an audit trail.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
An account password is set at registration and pairing codes expire, but complexity enforcement is minimal.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Aqara embedded Linux firmware (Companion App: Aqara Home app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: Onboard flash for device keys, automations and logs
|
| Power, Battery & Charging
|
Battery: • Power: Micro-USB 5 V 1 A • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: Ethernet RJ-45, 2.4 GHz Wi-Fi, Zigbee 3.0, Bluetooth Low Energy, IR blaster
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: The M2 is a capable multi-protocol hub but its 2025 CVE cluster is unusually specific and severe for a consumer device: undocumented remote access, command injection, missing certificate validation and an update path without integrity enforcement. Ecosystem integration (HomeKit/Alexa/Google) is broad, which is also a wide authentication surface. Scope note: rated on firmware 4.3.6_0027 as published; a later firmware that fixes the 2025 cluster could raise the device and system criteria. Release date is the M2 launch (year/month precision).
