Overview
- A single security key pulled from Meari’s Android app let a researcher reach cameras in 118 countries and view private images.
- Weak controls let attackers tap messages on Meari’s EMQX IoT platform and fetch motion snapshots stored on Alibaba servers through public links that do not expire.
- The probe logged five flaws as CVE-2026-33356, -33357, -33359, -33361, and -33362, covering live data eavesdropping, IP and location leaks, unencrypted images, reversible “encryption,” and hardcoded keys.
- Meari has closed most problems and paid the researcher €24,000, while he says the company earlier threatened him and has not clarified which brands were hit or how customers were warned.
- Because Meari’s tech is sold under 300-plus labels, users should look for meari.com.cn hostnames in their app, update to firmware 3.0.0 or later, change default passwords, or unplug cameras in private rooms.