VulnSocial

CVE-2026-33356Disclosure

LOWCVSS 7.7 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-05-11: 2Technical Details · 2026-05-11: 205-11
Signal classification1 categories
Disclosure
2100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Sammy Azdoufal@n0tsa
    Disclosure

    3/ CVE-2026-33356 (CVSS 7.7) : Subscribe to everyone else's camera. The MQTT broker enforces publish ACLs. Not subscribe ACLs. Any free account can subscribe to `meari/#` and read every device on the platform. 5 minutes test, one broker: 14,204 messages from 2,117 devices.

    Post summary

    The post describes how CVE‑2026‑33356 lets any free account subscribe to all devices via MQTT due to missing ACLs, but it provides no PoC, exploit, patch, or evidence of active attacks.

    100501.6K
    11.7K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33356 In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry fro… https://www.cve.org/CVERecord?id=CVE-2026-33356

    Post summary

    CVE‑2026‑33356 exposes a flaw in Meari IoT Cloud MQTT Broker deployments using EMQX 4.x, allowing authenticated low‑privilege users to subscribe to global wildcard topics and access telemetry data.

    00000153
    57.5K followersView on X

Explore more

Back to dashboard