CVE-2025-65293

Medium · 6.6

CVSS

6.6

EPSS

1.1%

Published

Dec 10, 2025

CISA due date

—

The record

Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR codes during device setup and factory reset.

Affected packages

Ecosystem	Package	Introduced	Fixed