The Aqara IAM/SSO Gateway (gw-builder.aqara.com) contains a hardcoded OAuth client credential, classified under CWE-798. This vulnerability allows remote attackers to compromise the system's confidentiality and integrity without any privileges or user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack can be performed remotely over the network with low complexity and no authentication. Although no patch or official remediation level is stated, this vulnerability is critical and can be leveraged in conjunction with other related CVEs to achieve full remote takeover of affected devices.

The vulnerability exposes the system to high confidentiality and integrity risks due to the hardcoded OAuth credentials. Attackers can exploit this flaw remotely without authentication or user interaction, potentially gaining unauthorized access and control. Combined with other related vulnerabilities, it may lead to a complete remote takeover of the affected Aqara devices. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No temporary or official fixes are currently documented.