What is the CVSS score of CVE-2026-33362?

CVE-2026-33362 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Meari IoT SDK are affected by CVE-2026-33362?

CVE-2026-33362 affects Meari SDK-based mobile applications (CloudEdge, Arenti, and white-label variants) through hardcoded cryptographic keys embedded in application binaries, enabling…

Meari IoT SDK CVE-2026-33362

Q: How to fix or mitigate CVE-2026-33362?

Within 24 hours: Identify and inventory all applications using Meari SDK (CloudEdge, Arenti, white-label variants) in production; notify security and product teams to escalate to Meari vendor for emergency patch timeline. Within 7 days: Contact Meari for confirmed patch release date and interim mitigation guidance; assess feasibility of forcing application updates or disabling affected services. Within 30 days: Deploy vendor-released patch to all affected applications via forced update mechanism; implement certificate pinning and runtime integrity checks to prevent future key extraction; conduct forensic analysis of cloud service access logs for evidence of unauthorized session hijacking since vulnerability discovery.

EUVD-2026-29106 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-05-11 runZero

GHSA-w7mj-frmj-5g6g

Information Disclosure Google

8.6

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 16:46 vuln.today

CVE Published

May 11, 2026 - 16:04 nvd

HIGH 8.6

DescriptionNVD

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.

AnalysisAI

Remote unauthenticated attackers can decrypt user credentials and hijack IoT device sessions in Meari SDK-based mobile applications (CloudEdge, Arenti, white-label apps) by exploiting hardcoded cryptographic keys shared across all installations. The SDK embeds API signing secrets, password-transport encryption keys, and service access tokens in application binaries, enabling adversaries to intercept and decrypt account credentials in transit, forge authenticated API requests, and potentially access cloud services without user authentication. …

RemediationAI

Within 24 hours: Identify and inventory all applications using Meari SDK (CloudEdge, Arenti, white-label variants) in production; notify security and product teams to escalate to Meari vendor for emergency patch timeline. Within 7 days: Contact Meari for confirmed patch release date and interim mitigation guidance; assess feasibility of forcing application updates or disabling affected services. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

More from same product – last 7 days

CVE-2026-44739 HIGH This Week

8.7 May 27

SQL injection in Pimcore's CustomReportsBundle (versions ≤ 12.3.5) lets an authenticated user holding the reports_config

CVE-2026-8842 MEDIUM This Month

6.4 May 27

Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenti

CVE-2025-68712 MEDIUM This Month

5.5 May 27

Authentication bypass in SpSoft AppLock 7.9.40 for Android allows a local attacker with physical device access to circum

CVE-2026-7552 MEDIUM This Month

5.3 May 28

Authorization bypass in the Geo Mashup WordPress plugin (all versions ≤ 1.13.19) exposes sensitive plugin configuration

CVE-2025-68709 MEDIUM This Month

5.2 May 26

Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app send

CVE-2026-33362 vulnerability details – vuln.today

Back

Meari IoT SDK CVE-2026-33362

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

More from same product – last 7 days

Share

External POC / Exploit Code