CVE-2026-50091

HighCVSS 7.4/10Last modified Jul 9, 2026

Description

Aqara Home Android (com.lumiunited.aqarahome) 6.0.0 (and white-label clients embedding the same liblumidevsdk.so) uses hard-coded cryptographic keys, which is an instance of "CWE-321: Use of Hard-coded Cryptographic Key" and has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical).

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-321 CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jun 12, 2026
Last modified: Jul 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-500939.0A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All version CVE-2026-500994.6During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UAR CVE-2026-50105.1A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaS CVE-2026-501008.5Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If thi CVE-2026-501018.1Naxclow devices use a server-side, per-device relay credential that never rotates and is re-issued to the device on each boot. Because this CVE-2026-501036.5A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing app CVE-2026-501054.3RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)CVE-2026-501066.5When NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for CVE-2026-501078.1When NGINX Plus or NGINX Open Source is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGIN CVE-2026-501087.5The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester CVE-2026-50116.3A vulnerability was detected in elecV2 elecV2P up to 3.8.3. This vulnerability affects the function runJSFile of the file /webhook of the co CVE-2026-501109.2Storage Concentrator (SC & SCVM) contains hardcoded credentials for numerous internal services embedded within a configuration file. While t