Meari IoT Cloud Platform OpenAPI Service
Meari IoT cloud OpenAPI flaws let authenticated users reconfigure others' devices and read device credentials.
CISA published ICSA-26-274-06 for every version of the Meari IoT Cloud Platform OpenAPI Service. CVE-2026-101104 (CVSS v3.1 7.7) lets an authenticated user change configuration or trigger behavior on devices they do not own. CVE-2026-96613 (CVSS v3.1 6.5) lets an authenticated user read any device shadow by device ID, exposing credentials, owner details, network data, and telemetry. Both are CWE-862 missing-authorization flaws, and CISA reports no known public exploitation.
- All versions of the Meari IoT Cloud OpenAPI Service are affected.
- CVE-2026-101104 lets authenticated users change devices they do not own, CVSS 7.7.
- CVE-2026-96613 exposes any device shadow, including credentials and owner data.
- Both issues are missing authorization (CWE-862).
- CISA reports no known public exploitation.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-96613+1 related CVE | Missing Authorization in Meari IoT Cloud OpenAPI | 7.1 group max | — |
From the original article
2 min read at cisa.govView CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.