Executive brief
Meari IoT Cloud, a platform used for smart home and baby monitor cameras, fails to properly secure motion alert images stored in the cloud. An unauthorized person who obtains a direct link to an image can view it without a password, and these links do not expire. This allows for the persistent exposure of private indoor photos, including sensitive images from baby monitors, even if the user changes their account credentials.
Technical details
The vulnerability is a case of missing authorization (CWE-862) within the Meari IoT Cloud's implementation of Alibaba OSS storage. Motion snapshots are stored using predictable or discoverable direct object references that do not require authentication or signed URLs for access. Furthermore, the storage service does not enforce expiry on these URLs, meaning they remain valid indefinitely. An attacker who obtains these URLs (potentially through other vulnerabilities like CVE-2026-33356) can retrieve private visual data without needing an active session or account access. This issue is particularly severe given the product's use in baby monitors and indoor security cameras.
Affected products
- Meari IoT Cloud alert image storage on Alibaba OSS Latest observed as of April 2026
Timeline
- 2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
- 2026-04-03: other: VINCE Case VU#579666 opened with CISA
- 2026-05-11: advisory: Public disclosure of vulnerability