Meari IoT Cloud Platform OpenAPI Service (CVE-2026-101104, CVE-2026-96613)
Meari IoT Cloud Platform OpenAPI Service has two missing-authorization flaws letting authenticated users alter device configs and read device credentials; no fix is planned. Two missing-authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI Service let any authenticated user manipulate or read data from devices they do not own. CVE-2026-101104 enables unauthorized configuration changes; CVE-2026-96613 leaks device credentials, owner details, and telemetry.
Detection / Hunteropenrouter
Immediate Actions
- Restrict internet exposure of Meari OpenAPI endpoints via firewall or reverse proxy ACLs.
- Contact Meari directly at their download center for patch availability status.
Key Takeaways
- CVE-2026-101104 allows authenticated users to manipulate device configurations without ownership verification.
- CVE-2026-96613 exposes full device shadow including credentials and owner details by specifying device ID.
- All versions of Meari IoT Cloud Platform OpenAPI Service are affected; no fix planned.
- Vendor Meari did not respond to CISA coordination attempts.
- Gabriel Adams reported both vulnerabilities to CISA.
Attack Chain
- Initial Access: Attacker authenticates to Meari IoT Cloud Platform OpenAPI Service with valid credentials
- Exploitation: Attacker specifies a device ID belonging to another user to access that device's shadow
- Manipulation: Attacker alters device configurations or triggers unintended behaviors without ownership checks
- Data Exposure: Device credentials, owner details, network data, and telemetry are disclosed
Affected Systems
- Meari IoT Cloud Platform OpenAPI Service (all versions)
- IoT devices managed via Meari cloud platform
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-101104 | Meari IoT Cloud Platform OpenAPI Service | High | Missing authorization allows authenticated users to alter device settings of unowned devices. |
| CVE-2026-96613 | Meari IoT Cloud Platform OpenAPI Service | Medium | Missing authorization exposes device shadow including credentials and network data by device ID. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | Vulnerabilities are in a cloud-hosted OpenAPI service, not endpoint-resident. |
| Network Visibility | Medium | API calls traverse the network; unusual cross-device access patterns may be visible in API logs. |
| Detection Difficulty | Moderate | Requires correlating authenticated API calls against device ownership mappings the platform itself does not enforce. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Single authenticated user accessing device shadows for multiple distinct device owners via OpenAPI (T1530) | API access logs with user-to-device mapping | Collection | Medium — legitimate admin accounts may access multiple devices |
| Authenticated API calls modifying device configurations without prior ownership verification (T1190) | API configuration change logs with auth context | Impact | Low — cross-owner config changes are abnormal |
Required Log Sources
- Meari OpenAPI access logs
- API gateway authentication logs
- Cloud platform audit logs
Key Behavioral Indicators
- Authenticated user querying device shadows for non-owned device IDs
- Configuration changes on devices outside the requester's ownership scope
- High-volume device shadow reads across multiple owners from one account
Control Gaps
- Missing server-side authorization on device ownership checks
- No rate limiting or anomaly detection on cross-device API access
False Positive Assessment
Low — exploitation requires valid authentication, but cross-owner device access is abnormal by design.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Isolate Meari cloud platform network segments from business networks.
- Require VPN for remote access to IoT control system networks.
- Monitor API logs for cross-owner device access patterns.
User Protection
- Rotate credentials for IoT devices managed through the Meari platform.
- Audit which users have authenticated access to the OpenAPI service.
MITRE ATT&CK Mapping
Initial Access
Collection
Plain-Language Summary
Meari's IoT cloud service has two security gaps where any logged-in user can change settings on or read sensitive data from devices that do not belong to them. The vendor has not responded to government coordination efforts, so no patch is available. Organizations using Meari should restrict internet exposure of the platform and contact the vendor directly.
- cveCVE-2026-101104Missing authorization allows authenticated users to alter device settings of unowned devices.
- cveCVE-2026-96613Missing authorization exposes device shadow including credentials and network data by device ID.