The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads and forwards them to its HiveMQ broker without requiring authentication, representing a CWE-306 vulnerability. This lack of authentication on a critical function allows an attacker to send commands remotely without any privileges or user interaction. The vulnerability has a CVSS 3.1 base score of 8.6 (High), with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, high integrity impact, and low availability impact. Although no patch or official remediation is currently documented, this vulnerability is part of a set of related issues that together can lead to complete remote takeover of affected devices running the 2026-04-20 version of the Board service.

The vulnerability allows unauthenticated remote attackers to send arbitrary MQTT commands to the HiveMQ broker used by the Aqara Board service, potentially manipulating device behavior. The CVSS score indicates a high severity with significant integrity impact and some confidentiality and availability impact. Alone, it compromises critical functions without authentication, and combined with other related CVEs, it can lead to full remote takeover of devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict network access to the Aqara Board service and monitor for suspicious MQTT traffic if possible.