CVE-2026-50085

Name of the Vulnerable Software and Affected Versions Aqara Board service (affected versions not specified)

Description The Aqara Board service at the endpoint "op-test.aqara.com" accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. This missing authentication for a critical function allows for unauthenticated MQTT command injection. When combined with other flaws, this can lead to a complete remote takeover of affected devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Monitor and isolate affected systems.