Meari IoT Cloud Platform OpenAPI Service has two missing-authorization flaws letting authenticated users alter device configs and read device credentials; no fix is planned. Two missing-authorization vulnerabilities in the Meari IoT Cloud Platform OpenAPI Service let any authenticated user manipulate or read data from devices they do not own. CVE-2026-101104 enables unauthorized configuration changes; CVE-2026-96613 leaks device credentials, owner details, and telemetry.
cisa-ics-advisory
1 post
Meari IoT Cloud Platform OpenAPI Service (CVE-2026-101104, CVE-2026-96613)