Aqara Camera Hub G3 (CH-H03)

Aqara Camera Hub G3 (CH-H03)
Security Grade B Calculator v	Aqara Camera Hub G3 Brand: Aqara (Parent: Lumi United Technology) Category: Camera • Model / Gen: CH-H03 Release Date: 2022-06-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	The microSD slot, reset control, and USB-C power connection are accessible; the unit is intended for indoor mounting.
Known vulnerabilities	Rare	🔗 Proof	NVD documents CVE-2025-65293: command injection with root privileges through a malicious QR code during setup or factory reset.
Prior attacks	None	🔗 Proof	No public model-specific botnet campaign was found.
Updatability	Very common	🔗 Proof	Aqara provides product-specific support and firmware/app updates.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Full	https://www.aqara.com/en/security-certifications/ 🔗 Proof	Supports HomeKit Secure Video and certified Apple/Google/Amazon integrations; HomeKit pairing provides a strong authenticated path.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Aqara states that camera data streams are encrypted and that WPA3 is supported.
Storage	Encrypted with obselete encryption	🔗 Proof	Supports local microSD and cloud storage; HomeKit Secure Video is end-to-end encrypted, but local microSD encryption is not documented.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	https://www.aqara.com/en/privacy-policy/ 🔗 Proof	Aqara Home account with family sharing; detailed administrator roles are not documented.
Authentication	Basic	https://www.aqara.com/en/privacy-policy/ 🔗 Proof	Account password login; device-specific 2FA is not documented.
Brute-force protection	Basic	https://www.aqara.com/en/privacy-policy/ 🔗 Proof	No public lockout/rate-limit policy; partial evidence only.
Event logging	Partial logging	🔗 Proof	The app records motion/alert events and local or cloud clips; a full administrator audit log is not documented.
Passwords	Require change after setup with complexity requirements	https://store-support.aqara.com/products/aqara-2k-security-indoor-camera-hub-g3 🔗 Proof	Setup uses a user-created Aqara account; no shared default device password is documented.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded firmware (Companion App: Aqara Home app (Android/iOS))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: No • Power: • Charging: No
Display & Camera	Display: No • Camera:
Sound & Connectivity	Sound: • Connectivity: 2.4 GHz Wi-Fi; Zigbee 3.0
Physical (Dimensions & Mass)	Dimensions: • Mass:

Prepared from public product documentation, vendor security information, and NVD records. The release date is approximate where the vendor did not state a day. No device was physically tested, scanned, or attacked. Each score links to the public evidence used for the assessment.