CVE-2026-96613

The Meari IoT Cloud Platform OpenAPI Service has a missing-authorization flaw (CWE-862) that lets any authenticated user read the complete device shadow of any device by supplying that device's ID. The service does not check that the requester owns or is otherwise related to the target device. A successful call discloses sensitive shadow data, including device credentials, owner details, network information, and telemetry, with high confidentiality impact and no integrity or availability impact. The issue affects users and devices on the Meari IoT cloud OpenAPI; affected version ranges are not stated in the advisory. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat any Meari cloud account as able to read another device's full shadow if the device ID is known, and restrict who can call the OpenAPI and which device IDs those calls may use. Rotate device credentials and review owner, network, and telemetry data for devices that may have been queried, and apply the vendor or ICS-CERT fix as soon as a patched OpenAPI build is published. Until then, monitor OpenAPI access logs for device-shadow reads where the caller has no relationship to the target device.