Meari vulnerabilities
We track 6 vulnerabilities in Meari products across 4 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 2, 2026.
Latest Meari vulnerabilities
- 7.7 High severity
IoT Cloud Platform OpenAPI Service: Missing Authorization
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as alter
- 8.6 High severity
com.meari.sdk: Use of Hard-coded Cryptographic Key
In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport
- 7.5 High severity
com.meari.sdk: Inadequate Encryption Strength
In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key
- 7.5 High severity
Alibaba OSS Hosted: Missing Authorization
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain va
- 7.5 High severity
com.meari.sdk: Missing Authorization
In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary
- 7.7 High severity
IoT Cloud MQTT Broker EMQX: Authorization Bypass Through User-Controlled Key
In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce