Aqara Home Android (com.lumiunited.aqarahome) version 6.0.0 and white‑label clients that embed the same liblumidevsdk.so use a hard‑coded cryptographic key. This flaw, a classic example of CWE‑321: Use of Hard‑coded Cryptographic Key, allows a malicious actor who can manipulate data on the device or spoof network traffic to decrypt or forge encrypted communications, thereby exposing or altering private data such as device identifiers, user settings, or other secrets. The vulnerability results in full confidentiality compromise and potential integrity tampering, while availability is not directly affected.

The affected product is Aqara Home Android application version 6.0.0 and any white‑label client that incorporates the identical liblumidevsdk.so library. No other versions of the app are listed as impacted in the advisory.

The CVSS score of 9.1 classifies the issue as Critical. EPSS is not available and it is not yet in the CISA KEV catalog. The most likely attack vector is local on the device; an adversary that can modify data sent to or from the application or influence the SDK’s processing can exploit the hard‑coded key. Remote exploitation would still require some form of initial device compromise to place the attacker’s payload or manipulated traffic in the device context.