CVE-2026-33359

Meari unauthenticated alert image access in cloud object storage

CVSS 7.5 HIGHEPSS 0.3%CWE-862

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Meari · Alibaba OSS Hosted

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/xn0tsa/nobody-puts-baby-in-a-corner https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/