The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads without requiring authentication and forwards them directly to the platform's HiveMQ broker. This constitutes a CWE-306 vulnerability where critical functions lack authentication controls. The vulnerability has a CVSS 3.1 base score of 8.6 (High), with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality (low), integrity (high), and availability (low). No official patch or remediation guidance is currently available. The vulnerability is part of a chain of related issues that together can lead to complete unauthenticated remote device takeover.

This vulnerability allows unauthenticated attackers to send arbitrary MQTT commands to the HiveMQ broker via the Aqara Board service, potentially compromising device integrity with high impact and confidentiality with low impact. Availability impact is low. Alone, it poses a significant risk, but combined with other related vulnerabilities, it can lead to full remote takeover of affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published. Until a patch is available, restrict network access to the Aqara Board service and monitor for suspicious MQTT traffic if possible.