Alibaba Oss Hosted
Monthly
Unauthenticated access to motion detection snapshots in Meari IoT Cloud allows remote attackers to retrieve security camera alert images stored on Alibaba OSS without authentication, signed URLs, or expiry enforcement. The vulnerability exposes IoT camera surveillance footage through predictable direct object references with confirmed proof-of-concept code publicly available. With CVSS 7.5 (High) and no authentication required (PR:N), this poses significant privacy risk to Meari camera deployments, though no active exploitation is confirmed via CISA KEV at time of analysis.
Unauthenticated access to motion detection snapshots in Meari IoT Cloud allows remote attackers to retrieve security camera alert images stored on Alibaba OSS without authentication, signed URLs, or expiry enforcement. The vulnerability exposes IoT camera surveillance footage through predictable direct object references with confirmed proof-of-concept code publicly available. With CVSS 7.5 (High) and no authentication required (PR:N), this poses significant privacy risk to Meari camera deployments, though no active exploitation is confirmed via CISA KEV at time of analysis.