Loading story…
Severe vulnerabilities in Meari Technology’s white-label IoT platform exposed more than 1 million baby monitors and security cameras across 118 countries, affecting devices sold under hundreds of brands on marketplaces including Amazon. Researcher Sammy Azdoufal reported that weaknesses in Meari’s hardware, mobile apps, SDKs, cloud services, and backend infrastructure allowed unauthorized access to MQTT message streams, device data, user email addresses, rough location information, WAN IP addresses, and real-time camera activity. Publicly accessible motion-alert images stored on Alibaba OSS and missing per-device access controls on Meari’s EMQX-based IoT platform left sensitive household photos and notifications exposed, raising particular concern for devices deployed in bedrooms, nurseries, and other private spaces.
Meari acknowledged that attackers could intercept messages without authorization and disclosed a potential remote code execution risk linked to weak passwords on a scheduled task platform. The company said it shut down the exposed EMQX platform, changed credentials, and advised firmware upgrades for devices running versions below 3.0.0, while Azdoufal said five CVEs were coordinated with runZero and CISA under VU#579666. A published disclosure timeline alleges Meari delayed responding, minimized some findings, used backdated advisories that covered only part of the issues, and failed to directly notify affected EU users or confirm GDPR breach reporting; Azdoufal later received a €24,000 bug bounty after an agreement preserved his right to publish the findings.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
After the disclosure, Azdoufal received a €24,000 bug bounty and filed five CVE reports related to the Meari vulnerabilities with support from runZero.
Subsequent reporting said the flaws affected more than 300 white-label brands sold through marketplaces such as Amazon, highlighting supply-chain risk in Meari's hardware, apps, SDKs, and cloud infrastructure.
On May 11, reporting and the research disclosure revealed that vulnerabilities in Meari's white-label ecosystem exposed roughly 1.1 million baby monitors and security cameras across 118 countries, including access to device data, MQTT streams, user details, and publicly reachable images.
Meari said it shut down the vulnerable EMQX IoT platform, changed credentials, and advised firmware upgrades for devices running versions below 3.0.0 in response to the reported flaws.
Azdoufal published a detailed disclosure timeline documenting the responsible disclosure process, unresolved architectural issues, and allegations that Meari did not directly notify affected EU users or confirm GDPR notifications to regulators.
On April 28, Azdoufal and Meari signed a final agreement allowing unrestricted publication on May 11 and removing proposed restrictive terms such as refund, long-term NDA, and non-disparagement clauses.
Five vulnerabilities remained in scope after retesting, and Azdoufal coordinated disclosure with Tod Beardsley of runZero and CISA VINCE case VU#579666.
According to the disclosure timeline, Meari initially described affected products as obsolete, minimized some findings, and published advisories that allegedly backdated fixes to March 2 while covering only part of the reported issues.
After Azdoufal reported the issues by email and LinkedIn, Meari did not respond for nine days despite repeated outreach, delaying the responsible disclosure process.
During the early audit, Azdoufal found exposed services including an EMQX dashboard with default credentials and a publicly accessible Apollo configuration server, along with broader weaknesses across Meari's platform.
Sammy Azdoufal began auditing Meari Technology's CloudEdge IoT ecosystem and related backend infrastructure, starting the investigation that uncovered multiple severe security issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcetheverge.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researcher Sammy Azdoufal publicly disclosed a broad set of vulnerabilities in Aqara’s cloud platform, including **CVE-2026-50084**, a critical authorization flaw in the production API that allowed any valid developer token to access user-scoped endpoints for arbitrary accounts. The issue, rated **CVSS 9.6** and classified as `CWE-862`, affected `open-cn.aqara.com/v3.0/open/api` and stemmed from missing per-account authorization checks rather than the platform’s MD5-based request-signing scheme. Aqara said the flaw was fixed in April, before public disclosure, but the researcher reported mixed remediation status across the wider set of findings. The disclosure tied **ten CVEs** to Aqara cloud, mobile, and developer systems, including hardcoded OAuth credentials in the IAM/SSO gateway (**CVE-2026-50083**), an unauthenticated MQTT debug interface in Aqara Board (**CVE-2026-50085**), an unauthenticated AES oracle (**CVE-2026-50086**), permissive CORS issues (**CVE-2026-50087**, **CVE-2026-50088**), an OAuth `redirect_uri` validation bypass (**CVE-2026-50090**), and hardcoded cryptographic keys in the Aqara Home Android SDK (**CVE-2026-50091**). According to the advisory and CVE records, several of these flaws could be chained with **CVE-2026-50084** to achieve **fully unauthenticated remote takeover of affected devices**, while the GitHub disclosure also alleged additional exposures in Aqara back-office infrastructure and disputed the vendor’s claim that the impact was limited to test environments.
Jun 29, 2026
A critical vulnerability was identified in CloudEdge online cameras and the associated app, allowing attackers to exploit improper neutralization of wildcards or matching symbols in MQTT topic inputs. The vulnerability, tracked as CVE-2025-11757, arises because the CloudEdge Cloud does not properly sanitize MQTT topic input, enabling an attacker to subscribe to a wildcard MQTT topic and receive messages intended for other users. Through this method, an attacker can intercept sensitive information, including credentials and key data necessary to connect to peer-to-peer cameras. The vulnerability is remotely exploitable and has been assigned a CVSS v4 base score of 8.7, indicating high severity. The affected product includes at least CloudEdge App version 4.4.2, with the potential for other versions or products to be impacted, though a comprehensive list of affected products is not yet available. The exploitation of this flaw could allow unauthorized access to live video feeds and camera controls, posing significant privacy and security risks to users worldwide. The vulnerability was reported by a researcher known as Ph4ng0t and disclosed through CISA and CVE advisories. CloudEdge and its parent company, Meari Technologies, have not responded to CISA's attempts at coordinated disclosure, and as of the latest advisories, no official mitigation or patch has been provided by the vendor. The vulnerability affects commercial facilities and is deployed globally, with the company headquartered in China. The lack of input sanitization in the MQTT protocol implementation is the core technical issue, making it possible for attackers to eavesdrop on communications and potentially compromise a large number of devices. The risk evaluation highlights that attackers could gain access to sensitive information, which could be used for further attacks or unauthorized surveillance. The advisories recommend that users remain vigilant and monitor for updates, but without vendor cooperation, users may need to consider additional network segmentation or device isolation as interim protective measures. The incident underscores the importance of secure MQTT implementation and the risks associated with hard-coded credentials and poor input validation in IoT devices. The vulnerability has drawn attention from both government and independent security researchers due to its potential impact on privacy and security. Organizations using CloudEdge products are advised to assess their exposure and consider alternative security controls until a vendor fix is available. The case also highlights ongoing challenges in coordinated vulnerability disclosure, especially with vendors that are unresponsive to security advisories.
Jun 29, 2026
Security researchers reported a **critical Moltbook** exposure caused by an unauthenticated database/API access issue that allowed enumeration of agent records (e.g., `GET /api/agents/{id}`) and leakage of **email addresses, JWT `login_token`s, and third-party `api_key`s**, enabling agent hijacking and downstream abuse of connected services. Separately, **Cal.com Cloud** was found vulnerable to a chained set of broken access controls and signup/invite-token logic flaws that enabled **complete account takeover** and access to sensitive booking data (attendee details, emails, and booking histories) at scale, including organizational accounts. In parallel, SentinelLabs documented that roughly **175,000 internet-exposed Ollama** instances were reachable due to common deployment misconfiguration (binding to `0.0.0.0`/public interfaces), creating conditions for **arbitrary code execution** and access to external resources—especially where tool-calling features were enabled. A distinct IoT case study described **Molekule** air purifiers exposing fleet-wide telemetry because an **AWS Cognito Identity Pool** permitted unauthenticated access to **AWS IoT Core MQTT** subscriptions, leaking device shadow data (e.g., Wi‑Fi SSIDs, MAC addresses, device names, sensor readings) for ~100,000 devices; the disclosed policy reportedly allowed read/subscribe access but not device control without per-device certificates.
Jun 29, 2026