Meari IoT Cloud Platform OpenAPI Service: 2 CVEs, High 7.7
Summary
CISA reports 2 vulnerabilities in Meari IoT Cloud Platform OpenAPI Service. Weakness type: Missing Authorization. Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. Highest CVSS v3 score: 7.7 (High), exploitable over the network.
At a glance
- Vendor
- Meari
- Products
- IoT Cloud Platform OpenAPI Service
- CVEs
- CVE-2026-101104, CVE-2026-96613
- Highest CVSS v3
- 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities, Information Technology
- Deployed
- Worldwide
- Vendor HQ
- China
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-101104 | Missing Authorization | 7.7 | – | No | The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions. |
| CVE-2026-96613 | Missing Authorization | 6.5 | – | No | The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device. |
Affected products (1)
- Meari IoT Cloud Platform OpenAPI Service: vers:all/*
Vendor fixes and mitigations (from advisory)
- No Fix Planned: Meari did not respond to CISA's coordination attempts. IoT Cloud Platform OpenAPI users are advised to contact Meari for support https://www.meari.com/en/downLoadCenter. link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.