Successful exploitation of these vulnerabilities, discovered by researcher Gabriel Adams, could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization.
Meari IoT Cloud Platform OpenAPI Service is a cloud-based application programming interface (API) infrastructure developed by Meari Technology. As a major Original Design Manufacturer (ODM) and white-label supplier, Meari provides the underlying hardware, software, and backend systems for more than 300 consumer smart camera, pet monitor, and baby monitor brands across 118 countries.
All versions of IoT Cloud Platform OpenAPI Service suffer from the vulnerabilities.
In one issue, the Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.
CVE-2026-101104 is the case number for the vulnerability, which has a CVSS V3 base score of 7.7. There is also a V4 base score of 6.3.
Authorization Flaw
Additionally, the Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device.
CVE-2026-96613 is the case number for the vulnerability, which has a CVSS V3 base score of 6.5. There is also a V4 base score of 7.1.
The product sees use in the commercial facilities and information technology sectors, and on a global basis.
No exploit currently targets these vulnerabilities.
In terms of mitigations, China-based Meari did not respond to CISA’s coordination attempts. IoT Cloud Platform OpenAPI users can click here for for support.