Is CVE-2026-50091 actively exploited?

No active exploitation of CVE-2026-50091 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-50091 be exploited remotely?

Yes. CVE-2026-50091 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-50091?

CVE-2026-50091 has a CVSS score of 7.4 (HIGH).

HOME VULNERABILITIESCVE-2026-50091

HIGH

CVE-2026-50091

CWE-321Published: June 12, 2026· Updated: Jul 9, 2026

7.4

CVSS v3.1

EPSS:0.25%probability of exploitation in 30 daysPercentile:15.6th

Official Description

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).

NVD Source

Risk Analysis

The Aqara Home Android application (com.lumiunited.aqarahome) version 6.0.0 and white-label clients are critically vulnerable due to the use of hard-coded cryptographic keys. This flaw, with a CVSS score of 9.1, allows an attacker to bypass cryptographic protections, potentially leading to unauthorized access and compromise of sensitive data.

No public exploit is currently known for this vulnerability. The attack vector is network-based and has low complexity, making it remotely exploitable.

Recommended Action

Users should update the Aqara Home Android application to a patched version once available. Developers should replace hard-coded cryptographic keys with securely generated and managed keys.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-50091 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 7.4.