Iot Cloud Platform Openapi Service
Monthly
Authenticated users of the Meari IoT Cloud Platform OpenAPI Service can retrieve the complete device shadow of any device on the platform simply by supplying that device's ID, because the service performs no ownership or authorization check on the request (CWE-862 Missing Authorization); CVSS 4.0 base score 7.1, assessed as CVSS 3.1 7.1 with high confidentiality impact and no integrity or availability impact. The attacker must hold valid credentials for the OpenAPI Service - the vector is PR:L, so any single legitimate device owner or registered developer account qualifies - and must know or be able to enumerate target device IDs; no user interaction or special configuration is required. Exposed data includes device credentials, owner details, network configuration, and telemetry, so a successful read can enable device takeover and account enumeration. Reporting comes from CISA ICS-CERT (ICSA-26-274-06); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the low-complexity, network-reachable nature of the flaw makes follow-on abuse plausible.
Missing ownership and permission verification in the Meari IoT Cloud Platform OpenAPI Service lets any holder of a valid platform account alter the configuration of devices they do not own, enabling unauthorized setting changes and unintended device behavior. The flaw is CWE-862 (Missing Authorization) with a vendor/ICS-CERT CVSS 4.0 base score of 6.3; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network reachability and high integrity impact, but exploitation requires an authenticated account (PR:L) and has no direct confidentiality or availability effect. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the low attack complexity and multi-tenant nature of the service nonetheless make it attractive to any legitimate-but-malicious tenant.
Authenticated users of the Meari IoT Cloud Platform OpenAPI Service can retrieve the complete device shadow of any device on the platform simply by supplying that device's ID, because the service performs no ownership or authorization check on the request (CWE-862 Missing Authorization); CVSS 4.0 base score 7.1, assessed as CVSS 3.1 7.1 with high confidentiality impact and no integrity or availability impact. The attacker must hold valid credentials for the OpenAPI Service - the vector is PR:L, so any single legitimate device owner or registered developer account qualifies - and must know or be able to enumerate target device IDs; no user interaction or special configuration is required. Exposed data includes device credentials, owner details, network configuration, and telemetry, so a successful read can enable device takeover and account enumeration. Reporting comes from CISA ICS-CERT (ICSA-26-274-06); no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the low-complexity, network-reachable nature of the flaw makes follow-on abuse plausible.
Missing ownership and permission verification in the Meari IoT Cloud Platform OpenAPI Service lets any holder of a valid platform account alter the configuration of devices they do not own, enabling unauthorized setting changes and unintended device behavior. The flaw is CWE-862 (Missing Authorization) with a vendor/ICS-CERT CVSS 4.0 base score of 6.3; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network reachability and high integrity impact, but exploitation requires an authenticated account (PR:L) and has no direct confidentiality or availability effect. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the low attack complexity and multi-tenant nature of the service nonetheless make it attractive to any legitimate-but-malicious tenant.