CVE-2026-50091: Aqara Home Android SDK hardcoded keys

Synopsis

This is a hardcoded cryptographic key vulnerability (CWE-321) in the Aqara Home Android app (com.lumiunited.aqarahome) version 6.0.0 and any white-label Android clients that bundle the same liblumidevsdk.so shared library. The flaw is reachable over the network with no authentication required, as the embedded keys can be extracted from the app binary and used to decrypt or forge network traffic. Successful exploitation gives an attacker the ability to read sensitive data and tamper with device communications. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the affected service over the network; the CVSS vector specifies AV:N, meaning no local or physical access is required.

• AuthenticationNot required

  No account or credential is needed; PR:N means the attacker can exploit the hardcoded keys without authenticating to any service.

• Victim interactionNot required

  UI:N means the attacker does not need to trick any user into taking an action; exploitation is fully passive from the victim's perspective.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free; extracting hardcoded keys from the app binary requires no race conditions or special environmental alignment.

Blast Radius

• Reads encrypted device-to-cloud traffic by decrypting it with the extracted hardcoded keys, exposing session tokens, device state, and user account data.
• Forges or replays signed messages to the Aqara cloud backend or to local hub devices, modifying device configuration and automation rules without authorization.
• Affects all white-label apps embedding the same liblumidevsdk.so, meaning the same extracted keys apply across multiple brand variants of the SDK.