Affected service and reported activity

CISA identifies all versions of Meari’s IoT Cloud Platform OpenAPI Service as affected by authorization vulnerabilities. For the configuration flaw, CVE-2026-101104, the agency says an authenticated user can change settings on devices belonging to someone else. The consequential distinction is between having an account and having permission over a particular device. CISA lists the service’s deployment as worldwide, with commercial facilities and information technology among the affected sectors.

The advisory records its initial release as October 1, 2026. CISA says it had received no reports of known public exploitation specifically targeting these vulnerabilities at that time. That statement describes the agency’s reported awareness; it does not establish that exploitation has never occurred or that affected devices are secure.

Access to device information

The second flaw, CVE-2026-96613, concerns access to information. According to CISA, an authenticated user can request a device’s complete shadow by supplying its device ID. The agency describes an authorization failure that permits access to any device’s shadow, making the permission boundary between the requester and the selected device central to the reported problem.

CISA says the exposed material can include credentials for devices, information about their owners, network data and telemetry. Its account therefore spans both device information and information about the people associated with it. The substantive privacy concern is that the service does not check the requester’s relationship to the targeted device before disclosing that material.

Defensive measures and their trade-offs

CISA recommends reducing network exposure as a defensive measure. Its guidance calls for keeping control system devices and systems off the public internet, placing control networks and remote devices behind firewalls, and separating them from business networks. For organizations considering those recommendations, the practical focus is how their systems can be reached and how their networks are separated.

Where remote access is necessary, CISA recommends methods such as VPNs, alongside keeping them current. The agency also cautions that VPNs can contain vulnerabilities and depend on the security of connected devices. This makes remote access protection conditional on the surrounding systems. CISA calls for an assessment of risk and operational impact before organizations introduce defensive measures, making those dependencies part of the decision.

Sources & context

  1. Meari IoT Cloud Platform OpenAPI Service | CISACISA

    Single-source report; claims attributed to the source, not independently verified. Source feed date (published): 2026-10-01T12:00:00.000Z. Study date: not established. Consulted: 2026-10-01T19:00:04.688Z.

AI assisted with preparing and checking this article. The responsible editor accepted this version for publication following an assisted review of facts, sources and attribution.

Related reading