Com Meari Sdk
Monthly
Remote unauthenticated attackers can decrypt user credentials and hijack IoT device sessions in Meari SDK-based mobile applications (CloudEdge, Arenti, white-label apps) by exploiting hardcoded cryptographic keys shared across all installations. The SDK embeds API signing secrets, password-transport encryption keys, and service access tokens in application binaries, enabling adversaries to intercept and decrypt account credentials in transit, forge authenticated API requests, and potentially access cloud services without user authentication. No public exploit code identified at time of analysis, but EPSS scoring and exploitation complexity are low given the static nature of hardcoded secrets.
Weak XOR obfuscation in Meari IoT SDK's libmrplayer.so library enables remote unauthenticated attackers to decrypt baby monitor image snapshots from CloudEdge 5.5.0, Arenti 1.8.1, and white-label apps (versions ≤1.8.x). The '.jpgx3' file format applies reversible XOR encryption only to the first 1024 bytes using a predictable key derivation model, exposing confidential video surveillance imagery. EPSS data unavailable; no CISA KEV listing or public exploit code confirmed, though proof-of-concept research published by runZero demonstrates practical decryption. CVSS 7.5 reflects HIGH confidentiality impact with network-accessible attack surface requiring no authentication.
Server-side authorization bypass in Meari SDK (com.meari.sdk) exposes WAN IP addresses of arbitrary IoT devices to unauthenticated remote attackers. Affects CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and white-label applications ≤1.8.x that embed the SDK. Attackers can enumerate device IPs by exploiting the openapi-euce.mearicloud.com endpoint without authentication (CVSS AV:N/PR:N), enabling reconnaissance for targeted attacks against exposed cameras and IoT infrastructure. EPSS data not available; no CISA KEV listing at time of analysis. Public vulnerability disclosure with technical details published by runZero.
Remote unauthenticated attackers can decrypt user credentials and hijack IoT device sessions in Meari SDK-based mobile applications (CloudEdge, Arenti, white-label apps) by exploiting hardcoded cryptographic keys shared across all installations. The SDK embeds API signing secrets, password-transport encryption keys, and service access tokens in application binaries, enabling adversaries to intercept and decrypt account credentials in transit, forge authenticated API requests, and potentially access cloud services without user authentication. No public exploit code identified at time of analysis, but EPSS scoring and exploitation complexity are low given the static nature of hardcoded secrets.
Weak XOR obfuscation in Meari IoT SDK's libmrplayer.so library enables remote unauthenticated attackers to decrypt baby monitor image snapshots from CloudEdge 5.5.0, Arenti 1.8.1, and white-label apps (versions ≤1.8.x). The '.jpgx3' file format applies reversible XOR encryption only to the first 1024 bytes using a predictable key derivation model, exposing confidential video surveillance imagery. EPSS data unavailable; no CISA KEV listing or public exploit code confirmed, though proof-of-concept research published by runZero demonstrates practical decryption. CVSS 7.5 reflects HIGH confidentiality impact with network-accessible attack surface requiring no authentication.
Server-side authorization bypass in Meari SDK (com.meari.sdk) exposes WAN IP addresses of arbitrary IoT devices to unauthenticated remote attackers. Affects CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and white-label applications ≤1.8.x that embed the SDK. Attackers can enumerate device IPs by exploiting the openapi-euce.mearicloud.com endpoint without authentication (CVSS AV:N/PR:N), enabling reconnaissance for targeted attacks against exposed cameras and IoT infrastructure. EPSS data not available; no CISA KEV listing at time of analysis. Public vulnerability disclosure with technical details published by runZero.