Meari IoT Cloud Platform OpenAPI Service

CISA has published an advisory regarding two Missing Authorization vulnerabilities (CVE-2026-101104 and CVE-2026-96613) affecting the Meari IoT Cloud Platform OpenAPI Service across all versions. CVE-2026-101104 allows authenticated users to manipulate configurations of devices they do not own, enabling unauthorized control of device settings and behaviors. CVE-2026-96613 allows authenticated users to access full device shadow data of any device by specifying its device ID, exposing credentials, owner details, and network data. Both vulnerabilities stem from CWE-862 (Missing Authorization) and require only low privileges with no user interaction. Meari did not respond to CISA coordination attempts and no fix is planned. The vulnerabilities affect critical infrastructure sectors including Commercial Facilities and Information Technology worldwide. CISA recommends network isolation, firewall segmentation, and VPN usage as mitigations.