Is CVE-2026-33362 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33362 being exploited in the wild.

How severe is CVE-2026-33362?

High severity, with a CVSS score of 8.6, published 11 May 2026.

Which products and versions are affected?

Meari IoT SDK Embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x.

Is there a fix for CVE-2026-33362?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-33362 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-33362?

Check whether you run Meari IoT SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33362: Meari IoT SDK hardcoded cryptographic keys in Android apps

Q: Is there a fix for CVE-2026-33362?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-33362 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-33362?

Check whether you run Meari IoT SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33362 · Severity: high · CVSS 8.6 · Published 2026-05-11

The Meari IoT SDK, used in various smart home camera applications like CloudEdge and Arenti, contains hardcoded security credentials. These secrets are used for signing API requests and protecting user passwords during transmission. Because these keys are identical across many different brands and devices, an attacker could potentially intercept or forge communications, leading to unauthorized access to user data or device control.

Technologies: Meari IoT SDK. Vendors: Meari.

Quick answers

Is CVE-2026-33362 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33362 being exploited in the wild.
How severe is CVE-2026-33362?: High severity, with a CVSS score of 8.6, published 11 May 2026.
Which products and versions are affected?: Meari IoT SDK Embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x.
Is there a fix for CVE-2026-33362?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-33362 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-33362?: Check whether you run Meari IoT SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Meari IoT SDK (com.meari.sdk) suffers from the use of hardcoded cryptographic keys (CWE-321). These secrets include API signing material, password-transport keying, and service access keys that are static and recoverable from client binaries. Because these keys are shared across different brands and tenants using the same SDK/backend model, trust decisions based on these keys are fundamentally compromised. An unauthenticated remote attacker can use these recovered secrets to perform request forgery, replay trusted operations, and facilitate large-scale automated abuse of the IoT ecosystem. This vulnerability significantly enhances the impact of other flaws in the same platform by providing the necessary signing context for malicious requests.

Affected products

Meari IoT SDK Embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x

Timeline

2026-03-11: disclosed: Issues identified and disclosed to vendor
2026-04-03: other: Opened VINCE Case VU#579666 with CISA
2026-05-11: advisory: Public disclosure of vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.