CVE-2026-50085: Aqara Board IoT insecure debug API

Synopsis

Missing authentication on a critical function in the Aqara Board IoT service (op-test.aqara.com) allows any network-accessible attacker to submit arbitrary MQTT command payloads that are forwarded directly to the platform's HiveMQ broker without any authentication check. The attack requires no credentials and no victim interaction, and successful exploitation enables partial data disclosure, significant data and state tampering, and partial service disruption on affected devices. When chained with CVE-2026-50082, CVE-50083, and CVE-50084, this vulnerability can result in fully unauthenticated remote device takeover. No upstream fix version is currently available; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable debug API endpoint is exposed over the network, so an attacker must be able to reach op-test.aqara.com or the HiveMQ broker from the internet or any connected network segment.

• AuthenticationNot required

  No credentials of any kind are checked before MQTT command payloads are accepted and forwarded; any unauthenticated sender can exploit this function.

• Victim interactionNot required

  The attacker sends payloads directly to the service endpoint and no action from a logged-in user or device owner is needed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special timing, race conditions, or environmental prerequisites on the attacker.

Blast Radius

• A successful attacker reads platform metadata and any low-sensitivity data exposed through the unauthenticated MQTT channel (Confidentiality: Low).
• A successful attacker writes arbitrary MQTT command payloads to the HiveMQ broker, modifying device state, configuration, and persisted command queues (Integrity: High).
• A successful attacker disrupts availability of affected devices or broker connections, causing partial service outages (Availability: Low).
• When combined with CVE-2026-50082, CVE-50083, and CVE-50084, a successful attacker achieves full unauthenticated remote takeover of affected Aqara Board devices.