Executive brief
A vulnerability in the Meari IoT SDK, used by popular baby monitor apps like CloudEdge and Arenti, allows unauthorized viewing of private images. The software uses a weak and predictable method to "scramble" photos instead of using strong encryption. This means that if an attacker gains access to the stored image files, they can easily convert them back into viewable photos, leading to a significant privacy breach for families using these devices.
Technical details
The vulnerability exists in the image handling component (libmrplayer.so) of the Meari IoT SDK. Specifically, '.jpgx3' files are protected using a reversible XOR operation applied only to the first 1024 bytes of the file. The key derivation model used for this operation is predictable, failing to provide robust cryptographic security (CWE-326). An attacker who obtains these files—potentially through other vulnerabilities like unauthenticated storage exposure—can programmatically reverse the obfuscation to recover the original JPEG images. This affects Meari-based white-label applications including CloudEdge and Arenti.
Affected products
- Meari IoT SDK (libmrplayer.so) <= 1.8.x
- Meari CloudEdge 5.5.0 (build 220)
- Arenti Arenti 1.8.1 (build 220)
Timeline
- 2026-03-11: disclosed: Issues identified by researcher and disclosed to vendor
- 2026-04-03: other: Opened VINCE Case VU#579666 with CISA
- 2026-05-11: advisory: Public disclosure of vulnerability