Sammy Azdoufal

**Name of the Vulnerable Software and Affected Versions** Aqara Home Android version 6.0.0 **Description** Aqara Home Android (com.lumiunited.aqarahome) and white-label clients embedding the `liblumidevsdk.so` library use hard-coded cryptographic keys. This occurs when a developer embeds a secret key directly into the source code, which can be extracted by an attacker to decrypt sensitive data or authenticate as a legitimate entity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO gateway (affected versions not specified) **Description** The IAM/SSO gateway at 'gw-builder.aqara.com' exposes an unauthenticated AES oracle, allowing bidirectional AES round-trips against the platform's signing key. This occurs due to missing authentication for a critical function and the use of a broken or risky cryptographic algorithm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO gateway (affected versions not specified) **Description** The Aqara IAM/SSO gateway at 'gw-builder.aqara.com' contains a cross-origin resource sharing issue. This is a permissive cross-domain policy with untrusted domains, which allows a website to make requests to a different domain than the one that served the original page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara Developer Portal (affected versions not specified) **Description** The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit permissive cross-origin request sharing. This is an instance of a permissive cross-domain policy with untrusted domains, which allows requests from unauthorized origins to access resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO Gateway (affected versions not specified) **Description** The Aqara IAM/SSO Gateway at 'gw-builder.aqara.com' contains an open redirect. This issue allows the system to redirect users to untrusted external sites, which can be leveraged to facilitate phishing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara Cloud (affected versions not specified) **Description** The OAuth Authorization Endpoint "open-cn.aqara.com/oauth/authorize" is subject to a redirect bypass caused by improper validation of unsafe equivalence in input. This flaw allows for domain matching bypass, which can be leveraged to facilitate phishing attacks and session theft. **Recommendations** Disable OAuth integration until a fix is available.

🚨 CVE-2026-50082 The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium). When combined with CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085, any otherwise-unauthenticated attacker could execute a full takeover of affected devices. 🎖@cveNotify

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

**Name of the Vulnerable Software and Affected Versions** Aqara Board service (affected versions not specified) **Description** The Aqara Board service at the endpoint "op-test.aqara.com" accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. This missing authentication for a critical function allows for unauthenticated MQTT command injection. When combined with other flaws, this can lead to a complete remote takeover of affected devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Monitor and isolate affected systems.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 build 220 Arenti version 1.8.1 build 220 Meari-based white-label applications versions 1.8.x and earlier **Description** Meari client applications embedding "com.meari.sdk" contain a server-side authorization failure. An attacker can abuse the integrated call path to 'openapi-euce.mearicloud.com' to retrieve the WAN IP address of arbitrary devices using their serial number. This is possible because the 'GET /openapi/device/status' endpoint does not require user authentication and utilizes a hardcoded signing key present in all public Meari-based applications. This issue is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Meari IoT Cloud (affected versions not specified) **Description** Motion snapshots stored on Alibaba OSS are retrievable without authentication, signed URLs, or expiry enforcement. The system uploads JPEG images to the storage service when motion is detected and broadcasts the URL via the MQTT stream. These URLs act as direct object references and remain valid indefinitely, allowing anyone to access the images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label apps versions 1.8.x and earlier **Description** In the Meari IoT SDK image handling within the `libmrplayer.so` library, baby monitor images using the ".jpgx3" extension are protected by a reversible XOR operation. This operation only affects the first 1024 bytes of the JPEG file and utilizes a predictable key derivation model based on the MD5 hash of the device serial, the length of the serial, and a secret. The serial number is transmitted within the same MQTT message, facilitating the decryption of the images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label Android apps versions 1.x and earlier **Description** Meari IoT SDK builds contain multiple security-critical secrets that are hardcoded and shared across the ecosystem. These include API signing material, password-transport keying, and service access keys. Specifically, every Meari-based app utilizes the same HMAC secret (a key used for Hash-based Message Authentication Codes to verify data integrity), the same DES key (Data Encryption Standard) for passwords, the same OpenAPI key, and the same P2P password. These keys cannot be rotated without re-flashing every device in the field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EMQX versions 4.x **Description** In Meari IoT Cloud MQTT Broker deployments, an authenticated low-privilege account can subscribe to global wildcard topics, such as `meari/#`, allowing the user to receive telemetry from devices they do not own. While the broker enforces publish Access Control Lists (ACLs), it fails to enforce equivalent subscribe authorization at the per-device scope. In a real-world test on a single broker, this allowed the capture of 14,204 messages from 2,117 devices. **Recommendations** Update EMQX versions 4.x to a version where subscribe authorization is properly enforced at the per-device scope.