CVE-2026-101104

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-03

Assigner: ICS-CERT

Description

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-03

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101104

EUVD

EUVD-2026-91746

Affected Vendors & Products

Vendor	Product	Version / Range
Meari	IoT	Cloud Platform OpenAPI Service All verisons

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Meari IoT Cloud Platform OpenAPI Service has an authorization flaw that lets authenticated users change settings for devices they do not own. This allows unauthorized actions like modifying device configurations or triggering behaviors without proper permission checks.

Detection Guidance

This vulnerability involves an authorization flaw in the Meari IoT Cloud Platform OpenAPI Service. Detection requires checking for unauthorized access to device configurations or shadow data. Monitor API logs for requests to endpoints manipulating device settings without proper ownership verification. Use network traffic analysis tools like Wireshark to inspect HTTP requests to the OpenAPI service for suspicious device ID manipulations.

Impact Analysis

Attackers could alter your device settings, cause unintended behaviors, or access sensitive functions without your consent. This may lead to privacy breaches, device malfunctions, or loss of control over your IoT devices.

Compliance Impact

This vulnerability could violate data protection and privacy regulations like GDPR or HIPAA by enabling unauthorized access or control over devices handling sensitive data. Compliance may be compromised due to insufficient access controls and permission verification.

Mitigation Strategies

Immediately review and restrict API access permissions to ensure users can only modify devices they own. Disable or remove unused API endpoints and enforce strict ownership verification for all device configuration changes.

Hi! I’m here to help you understand CVE-2026-101104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70