com.meari.sdk vulnerabilities

3 known vulnerabilities in com.meari.sdk from Meari. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  com.meari.sdk: Use of Hard-coded Cryptographic Key

  CVE-2026-33362May 11, 2026Meari

  In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport

• 7.5 High severity

  com.meari.sdk: Inadequate Encryption Strength

  CVE-2026-33361May 11, 2026Meari

  In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key

• 7.5 High severity

  com.meari.sdk: Missing Authorization

  CVE-2026-33357May 11, 2026Meari

  In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary