Aqara Home Android SDK hardcoded keys

Executive summary #

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).

Technical details #

Two static cryptographic keys are baked into the native library liblumidevsdk.so. Both are recoverable via strings from any installation. Both keys are identical across every install of the app and every white-label build. They control camera authentication signatures, device pairing payloads, and content encryption between client and platform. They cannot be rotated without a coordinated firmware + app update across the entire ecosystem.

Further technical details for this issue can be found at https://github.com/xn0tsa/theres-no-place-like-home

Attacker value #

This vulnerability can enable forgery of camera authentication signatures, impersonation of device pairing flows, and decryption of encrypted content captured from privileged MITM positions.

Credit #

These issues were discovered, documented, and disclosed by Sammy Azdoufal. CVE coordination was performed by Tod Beardsley of runZero, Inc.

Timeline #

2026-03-13: Set of issues discovered by the researcher and outreach to the vendor initiated

2026-03-30: Second outreach by the researcher

2026-04-08: Various findings and vulnerabilities remediated by the vendor

2026-04-20: Acknowledged the researcher's reporting, fixes claimed for most issues

2026-04-20: Some issues remained unfixed

2026-06-12: This public disclosure (90 days from first contact) 

For more details on specific findings and fixes, please see the researcher's website at https://github.com/xn0tsa/theres-no-place-like-home.