CVE-2026-33362: Meari IoT SDK Information Disclosure Flaw

CVE-2026-33362 Overview

CVE-2026-33362 is a hardcoded cryptographic key vulnerability [CWE-321] in Meari IoT SDK builds embedded in multiple consumer camera and smart device applications. The affected SDK ships with shared, hardcoded secrets including API signing material, password-transport keying, and service access keys. Because these secrets are identical across all deployments using the SDK, any attacker who extracts them from a single application binary can reuse them against the entire fleet of devices and accounts. The flaw spans CloudEdge, Arenti, and a broad set of white-label Android applications built on the same SDK.

Critical Impact

Attackers who extract the embedded keys from any vulnerable Android app can forge signed API requests and decrypt password transport material across all installations sharing the SDK.

Affected Products

• Meari IoT SDK as embedded in CloudEdge 5.5.0 (build 220)
• Meari IoT SDK as embedded in Arenti 1.8.1 (build 220)
• White-label Android applications based on the Meari SDK at versions <= 1.8.x

Discovery Timeline

• 2026-05-11 - CVE-2026-33362 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-33362

Vulnerability Analysis

The Meari IoT SDK embeds long-lived cryptographic secrets directly into client application binaries. These secrets are not user-specific or device-specific. Every installation of CloudEdge, Arenti, and the white-label apps based on the SDK ships with the same values. The hardcoded material covers three distinct security functions: API request signing, password transport encryption, and authentication to backend services.

The scope is changed because compromise of a single client binary affects the security of every account and device that interacts with the shared Meari cloud backend. Confidentiality impact is high because the keys protect credential transport and signed API operations. The vulnerability requires no authentication, no user interaction, and is exploitable over the network.

Root Cause

The root cause is the use of hardcoded cryptographic keys in shipped binaries, classified under [CWE-321]. The SDK design treats the embedded keys as application-level secrets, but Android APKs are trivially decompilable. Static strings, native libraries, and resource files all expose the values. Because the keys are reused across vendors and white-label builds, there is no key-rotation or per-tenant boundary that would limit blast radius.

Attack Vector

An attacker downloads any affected Android application from a public source and extracts the signing key, password-transport key, and service access keys through static analysis of the APK. With these secrets, the attacker can compute valid request signatures for the Meari backend, decrypt or forge password-transport payloads, and authenticate to backend services that trust the embedded credentials. The attack does not require access to a victim device or account. See the RunZero Security Advisory and the GitHub PoC Repository for full technical detail.

No verified exploitation code is reproduced here. Refer to the linked PoC repository for the extraction and signing workflow.

Detection Methods for CVE-2026-33362

Indicators of Compromise

• Outbound API calls to Meari cloud endpoints originating from non-mobile network ranges or automated user agents.
• Repeated authentication or signed-request traffic to Meari backends from a single source IP across many account identifiers.
• Account activity on CloudEdge or Arenti from geolocations that do not match the registered user's device history.
• Unexpected device pairing, sharing, or live-stream session events on consumer camera accounts.

Detection Strategies

• Inventory mobile and IoT assets to identify installations of CloudEdge, Arenti, and other Meari-based applications using software composition analysis.
• Monitor for credential reuse and password reset anomalies on accounts tied to affected mobile applications.
• Inspect network egress for connections to known Meari API hosts and flag non-mobile clients producing signed requests.

Monitoring Recommendations

• Centralize mobile device management (MDM) telemetry to track installed versions of affected white-label apps.
• Alert on bulk enumeration patterns against Meari cloud endpoints, including high-volume signed API calls from single sources.
• Correlate camera and IoT account events with user identity telemetry to surface unauthorized session activity.

How to Mitigate CVE-2026-33362

Immediate Actions Required

• Identify and remove or restrict use of CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label apps at <= 1.8.x until fixed builds are available.
• Rotate any user credentials that were entered into affected applications, especially passwords reused on other services.
• Restrict affected IoT devices to isolated network segments that block direct exposure to untrusted networks.

Patch Information

No vendor patch or fixed SDK version is referenced in the public advisory at the time of NVD publication. Consult the RunZero Security Advisory for vendor response status and any subsequent SDK updates from Meari.

Workarounds

• Disable remote access and cloud features on affected cameras where the device supports local-only operation.
• Place affected IoT devices behind a firewall that restricts outbound communication to required Meari endpoints only.
• Use unique, strong passwords on Meari-based accounts and enable multi-factor authentication if offered by the vendor.
• Remove unused white-label IoT applications from managed mobile devices to reduce exposure of the shared SDK secrets.

# Example egress restriction for IoT VLAN (illustrative)
# Block IoT segment from initiating connections outside required cloud hosts
iptables -A FORWARD -i iot0 -d <meari-cloud-cidr> -j ACCEPT
iptables -A FORWARD -i iot0 -j DROP