Critical Authorization Flaws in Meari IoT Platform Expose Devices to Takeover

What Happened

CISA has disclosed critical authorization vulnerabilities (CVE-2026-101104, CVE-2026-96613) affecting all versions of the Meari IoT Cloud Platform OpenAPI Service, a widely deployed system for IoT cameras and smart devices. The flaws allow authenticated attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive data—including device credentials, owner information, and network details—for devices they don't own. With a CVSS score of 7.7 and global deployment across commercial facilities and IT environments, these vulnerabilities represent a significant supply chain risk.

Why SMBs Should Care

Many small and mid-sized businesses rely on affordable IoT cameras and sensors for physical security, often without realizing the cloud platforms behind them. If your organization uses Meari-powered devices (often white-labeled under different brands), attackers could potentially access video feeds, disable cameras, or pivot into your network using stolen credentials. This is a textbook case of vendor risk: a third-party platform vulnerability can bypass your own security controls. SMBs should immediately inventory IoT devices, segment them on isolated networks, enforce strong authentication, and verify vendor security practices. If you're unsure whether your devices are affected, now is the time to audit your infrastructure.

Read the full CISA advisory

Take Action

Not sure what IoT devices are on your network or how to secure them? O-Cyrus helps SMBs assess vendor risks, segment infrastructure, and implement practical security controls. Contact us or explore our security services to protect your business from supply chain vulnerabilities.