Executive brief
Meari IoT Cloud uses an MQTT broker to manage communications between smart home devices, such as security cameras, and their owners. A security flaw allows any registered user to bypass privacy controls and subscribe to data streams belonging to other customers. An attacker could use this to monitor platform-wide device activity, access alert metadata, and obtain links to private camera images, leading to large-scale surveillance and data exposure.
Technical details
The Meari IoT Cloud MQTT Broker, specifically deployments utilizing EMQX 4.x, fails to enforce proper Access Control Lists (ACLs) for subscription requests at a per-device scope. While the broker correctly restricts publishing, it allows any authenticated low-privilege account to subscribe to global wildcard topics (e.g., using '#' or '+'). This vulnerability, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), enables an attacker to ingest platform-wide event streams. This includes sensitive telemetry such as device identifiers, alert metadata, and URLs to camera artifacts, which can be further used to facilitate follow-on attacks. The vulnerability is reachable over the network and requires only a standard user account.
Affected products
- Meari IoT Cloud MQTT Broker (EMQX 4.x) EMQX 4.x
Timeline
- 2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
- 2026-04-03: other: VINCE Case VU#579666 opened with CISA for tracking
- 2026-05-11: advisory: Public disclosure of CVE-2026-33356