CVE-2026-101104

LOWCVSS 6.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

NewsTongue@NewsTongueX1d
🔴 Meari IoT Platform Has Unpatched Authorization Flaws Affecting All Versions Meari IoT Cloud Platform OpenAPI Service contains two authorization vulnerabilities (CVE-2026-101104, CVE-2026-96613) that allow authenticated users to manipulate device configurations they do not own and access sensitive data—including device credentials, owner details, and network telemetry—by specifying any device ID. • Affected: All versions of the service; deployed worldwide across commercial facilities and IT infrastructure; company headquartered in China • No fix planned. Meari did not respond to CISA coordination attempts • No known public exploitation reported to date
0000029
951 followersView on X

Explore more

Back to dashboard