The Aqara IAM/SSO Gateway hosts a permissive Cross‑Origin Resource Sharing policy that satisfies the definition of CWE‑942. An attacker can send HTTP requests from a malicious web origin and receive the gateway’s responses, allowing the unauthorized disclosure of confidential data such as SSO tokens or configuration. The vulnerability is characterised by a CVSS v3.1 score of 8.2, signalling high confidentiality impact and low attack complexity, but it does not provide for remote code execution or privilege escalation.

The affected vendor is Aqara and the product is the Aqara IAM/SSO Gateway. No version information is documented in the advisory; the issue applies to any deployment of the gateway.

A high CVSS score indicates significant risk; however, the EPSS score is not available and the vulnerability has not been listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector is a remote origin that can reach the gateway unit, typically via a web browser or automated script. If the gateway is exposed to the wider Internet or to untrusted internal networks, an attacker could orchestrate automated cross‑origin calls to harvest sensitive data.