Skip to content
OpenAdvisories
High ICSA-26-274-06 2 CVEs

Meari IoT Cloud Platform OpenAPI Service (Update A)

Published Oct 1, 2026 · Updated Oct 22, 2026 · Revision 2

Vendor: Meari Product: IoT Cloud Platform OpenAPI Service

Summary

Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization.

Vulnerabilities 2

  • High 7.7
    CVE-2026-101104

    Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

    The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as alte…

    Meari IoT Cloud Platform OpenAPI Service
  • Medium 6.5
    CVE-2026-96613

    Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

    The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as devic…

    Meari IoT Cloud Platform OpenAPI Service

Revision history

  1. #2

    Update A - Added vendor remediations for both CVEs

  2. #1

    Initial Publication

References