Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated call path to openapi-euce.mearicloud.com can be abused to retrieve WAN IP data for arbitrary devices. The root cause is a server-side authorization failure in "GET /openapi/device/status".
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
4/ CVE-2026-33357 (CVSS 7.5) : Device-status IDOR. GET /openapi/device/status returns the WAN IP of any camera by serial number. No user authentication. The signing key is hardcoded in every Meari-based app shipped to the public.
Post summary
The tweet discloses CVE‑2026‑33357, an IDOR that exposes a camera’s WAN IP without authentication.
CVE-2026-33357 In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated… https://www.cve.org/CVERecord?id=CVE-2026-33357
Post summary
The text offers a brief disclosure of CVE-2026-33357, mentioning affected Meari client builds but lacking technical, exploit, or mitigation details.