Meari IoT Cloud EUVD-2026-91746

Requires a valid authenticated account on the Meari IoT Cloud Platform OpenAPI Service (PR:L) - exploitation is not possible for fully unauthenticated outsiders. Given that precondition, no further special configuration is needed: any logged-in user can invoke OpenAPI calls against devices they do not own because the service omits ownership/permission verification (CWE-862). No user interaction is required (UI:N) and the attack is network-reachable (AV:N). The primary limiting factor is the need to obtain platform credentials; impact is bounded to device integrity (altering settings/triggering behaviors), with no direct confidentiality or availability effect per the CVSS vector.

This is a moderate-severity authorization flaw (CWE-862, Missing Authorization) in the Meari IoT Cloud Platform OpenAPI Service, with a vendor/ICS-CERT CVSS 4.0 base score of 6.3. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low privileges - i.e., any authenticated platform user (PR:L) can abuse the flaw against devices they do not own. Impact is narrow and integrity-focused: the vector rates subsequent-system integrity high (SI:H) while confidentiality and availability are rated none (VC:N/VI:N/VA:N/SC:N/SA:N), matching a description centered on unauthorized configuration changes rather than data theft or outages. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation is not confirmed in the wild and there is no evidence of mass exploitation probability - this limits real-world urgency relative to the CVSS number. The combination of low attack complexity plus a low authentication barrier means exploitation is technically easy for anyone who can register/obtain a platform account, so this is a genuine (not purely theoretical) issue, but the absence of KEV/POC/EPSS signals and the integrity-only, device-scoped impact place it as a real-but-not-emergency priority. Note the input Tag 'Authentication Bypass' conflicts with the actual mechanism: PR:L and CWE-862 describe an authorization (post-authentication) flaw, not an authentication bypass - verify categorization with the CISA ICS advisory.

An attacker registers or already holds a legitimate low-privilege account on the Meari IoT Cloud Platform, then issues OpenAPI requests referencing device identifiers belonging to other customers. Because the service does not verify ownership, the attacker alters those devices' settings or triggers unintended behaviors. No public exploit code was identified at time of analysis, but given AV:N and AC:L the request manipulation is straightforward for any authenticated user.