CVE-2026-96613
Received Received - Intake

Meari IoT Cloud Platform Authorization Bypass Exposes Device Data

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: ICS-CERT

Description
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner details, network data, and telemetry, without verifying any relationship between the requester and the target device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-96613
EUVD
EUVD-2026-91750

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
meari iot_cloud_platform_openapi_service *
meari csafpid-0001 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Meari IoT Cloud Platform OpenAPI Service has an authorization flaw where authenticated users can access the complete device shadow of any device by specifying its device ID. This exposes sensitive data like device credentials, owner details, network data, and telemetry without verifying if the requester is related to the target device.

Impact Analysis

An attacker could exploit this to steal sensitive information from any device on the platform, including credentials and network details. This could lead to unauthorized access, data breaches, or further attacks on connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using this platform may face compliance violations and legal consequences.

Mitigation Strategies

Minimize network exposure for affected devices by isolating them behind firewalls. Use secure remote access methods like VPNs when necessary. Contact Meari for support as no fix is planned.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart