Read the docs

Aqara

Records18All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Aqara records in CISA KEV

No Aqara vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Camera Hub G3 Firmware 8 records HIGH Hub M2 Firmware 7 records HIGH Hub M3 Firmware 7 records HIGH Iam/sso Gateway 4 records HIGH Board Service 1 record HIGH Cloud Developer Portal 1 record HIGH Cloud Oauth Authorization Endpoint 1 record HIGH Cloud Production Api 1 record HIGH

Records

1 record in Cloud Production Api · all components

TI-2026-36877 CVE-2026-50084 · GHSA-4mvx-j4wr-wqrc

Aqara API cross-account access

Priority HIGH 76

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00244 Published 2026-06-12 Fixed in 0 CWE-862
Open these records in search →