The Aqara Home Android application (com.lumiunited.aqarahome) version 6.0.0, including white-label clients using the same native library liblumidevsdk.so, contains hard-coded cryptographic keys. This is a CWE-321 vulnerability, meaning cryptographic keys are embedded directly in the code rather than being securely managed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the vulnerability is remotely exploitable without authentication or user interaction, and can lead to complete compromise of confidentiality and integrity of protected data, though availability is not affected. No official patch or remediation guidance is currently available from the vendor.

Exploitation of this vulnerability could allow attackers to decrypt or manipulate sensitive data protected by the hard-coded keys, leading to a total loss of confidentiality and integrity. Since no privileges or user interaction are required, the attack surface is broad. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users and administrators should consider limiting exposure of the affected application and monitor for updates from Aqara. Avoid deploying version 6.0.0 in sensitive environments if possible.