Executive brief
The Meari IoT SDK, used in various smart home camera applications like CloudEdge and Arenti, contains hardcoded security credentials. These secrets are used for signing API requests and protecting user passwords during transmission. Because these keys are identical across many different brands and devices, an attacker could potentially intercept or forge communications, leading to unauthorized access to user data or device control.
Technical details
The Meari IoT SDK (com.meari.sdk) suffers from the use of hardcoded cryptographic keys (CWE-321). These secrets include API signing material, password-transport keying, and service access keys that are static and recoverable from client binaries. Because these keys are shared across different brands and tenants using the same SDK/backend model, trust decisions based on these keys are fundamentally compromised. An unauthenticated remote attacker can use these recovered secrets to perform request forgery, replay trusted operations, and facilitate large-scale automated abuse of the IoT ecosystem. This vulnerability significantly enhances the impact of other flaws in the same platform by providing the necessary signing context for malicious requests.
Affected products
- Meari IoT SDK Embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x
Timeline
- 2026-03-11: disclosed: Issues identified and disclosed to vendor
- 2026-04-03: other: Opened VINCE Case VU#579666 with CISA
- 2026-05-11: advisory: Public disclosure of vulnerability