Meari IoT Cloud EUVD-2026-91750

The attacker must possess valid credentials for the Meari IoT Cloud Platform OpenAPI Service (PR:L - any authenticated OpenAPI account, including a single legitimate device owner or registered developer); no further special configuration, feature flag, or non-default deployment mode is required, as the missing authorization check is inherent to the device-shadow endpoint's default behavior. The attacker must also know or be able to enumerate the target device IDs. Limiting factors: exploitation requires authentication (not anonymous/pre-auth), and value depends on the attacker obtaining or guessing valid device IDs; there is no user interaction requirement and no reliance on victim misconfiguration, so once authenticated the attack works against the service as shipped.

This is a genuine, moderately-high-priority confidentiality issue rather than a theoretical high-CVSS finding, but it is gated by one key prerequisite. The provided CVSS 4.0 vector (7.1, High) shows network attack (AV:N), low complexity (AC:L), no attack requirements (AT:N), low privileges (PR:L - i.e. an authenticated OpenAPI account), no user interaction (UI:N), and a confidentiality-only impact (VC:H / VI:N / VA:N) with no subsequent-system impact. The core weakness (CWE-862, Missing Authorization) is a classic IDOR: any authenticated caller can retrieve any device's shadow by supplying its device ID, which makes the flaw highly automatable (an attacker can iterate device IDs programmatically to harvest data at scale). No EPSS score, SSVC decision block, KEV entry, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals do not conflict, they are simply incomplete. The main factor elevating real-world concern beyond the raw score is the nature of the leaked data: exposed device credentials and network data could enable downstream device compromise even though this CVE itself scores no integrity/availability impact. Net: a real priority for anyone relying on this platform's privacy guarantees, tempered by the need for a valid account and the absence of any exploitation-probability data (EPSS/SSVC missing - cannot quantify likelihood).

An attacker who holds a valid low-privilege Meari OpenAPI account (e.g. a registered developer or a single legitimate device owner) scripts requests against the device-shadow endpoint, iterating through or enumerating device IDs they do not own. Because the service never checks the requester-to-device relationship, each request returns another device's credentials, owner details, network data, and telemetry, enabling bulk harvesting. No public exploit code is identified at time of analysis, but the flaw is trivially scriptable given the low attack complexity.