Tod Beardsley

In ServerCo getssl version 2.49 and prior, the ACME challenge token returned to the client was not strictly validated against RFC 8555 before being used in challenge-file handling, allowing a maliciously crafted token to influence local path/filename usage during validation. An attacker who can supply ACME challenge responses to getssl (for example, a malicious or compromised CA endpoint, or an on-path adversary able to tamper with that response path) could exploit this to achieve unauthorized file write/path traversal effects, usually with elevated privileges, ultimately allowing for remote command injection. This issue appears related in spirit to CVE-2023-38198, and is an instance of CWE-73, "External control of file name or path." Other ACME shell script handlers may be affected by similar issues.

**Name of the Vulnerable Software and Affected Versions** Aqara Cloud (affected versions not specified) **Description** The OAuth Authorization Endpoint "open-cn.aqara.com/oauth/authorize" is subject to a redirect bypass caused by improper validation of unsafe equivalence in input. This flaw allows for domain matching bypass, which can be leveraged to facilitate phishing attacks and session theft. **Recommendations** Disable OAuth integration until a fix is available.

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO Gateway (affected versions not specified) **Description** The Aqara IAM/SSO Gateway at 'gw-builder.aqara.com' contains an open redirect. This issue allows the system to redirect users to untrusted external sites, which can be leveraged to facilitate phishing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CVE-2026-50085 - Aqara Board IoT insecure debug API CVE ID :CVE-2026-50085 Published : June 12, 2026, 4:16 p.m. | 1 hour, 18 minutes ago Description :The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated CVSS ofCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (8.6 High). When combined with CVE-2026-50082, CVE-50083, and CVE-50084, this can lead to a fully unauthenticated, remote takeover of affected devices. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

**Name of the Vulnerable Software and Affected Versions** Aqara Home Android version 6.0.0 **Description** Aqara Home Android (com.lumiunited.aqarahome) and white-label clients embedding the `liblumidevsdk.so` library use hard-coded cryptographic keys. This occurs when a developer embeds a secret key directly into the source code, which can be extracted by an attacker to decrypt sensitive data or authenticate as a legitimate entity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO gateway (affected versions not specified) **Description** The Aqara IAM/SSO gateway at 'gw-builder.aqara.com' contains a cross-origin resource sharing issue. This is a permissive cross-domain policy with untrusted domains, which allows a website to make requests to a different domain than the one that served the original page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO gateway (affected versions not specified) **Description** The IAM/SSO gateway at 'gw-builder.aqara.com' exposes an unauthenticated AES oracle, allowing bidirectional AES round-trips against the platform's signing key. This occurs due to missing authentication for a critical function and the use of a broken or risky cryptographic algorithm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara Board service (affected versions not specified) **Description** The Aqara Board service at the endpoint "op-test.aqara.com" accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. This missing authentication for a critical function allows for unauthenticated MQTT command injection. When combined with other flaws, this can lead to a complete remote takeover of affected devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Monitor and isolate affected systems.

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

**Name of the Vulnerable Software and Affected Versions** Aqara Developer Portal (affected versions not specified) **Description** The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit permissive cross-origin request sharing. This is an instance of a permissive cross-domain policy with untrusted domains, which allows requests from unauthorized origins to access resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label apps versions 1.8.x and earlier **Description** In the Meari IoT SDK image handling within the `libmrplayer.so` library, baby monitor images using the ".jpgx3" extension are protected by a reversible XOR operation. This operation only affects the first 1024 bytes of the JPEG file and utilizes a predictable key derivation model based on the MD5 hash of the device serial, the length of the serial, and a secret. The serial number is transmitted within the same MQTT message, facilitating the decryption of the images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EMQX versions 4.x **Description** In Meari IoT Cloud MQTT Broker deployments, an authenticated low-privilege account can subscribe to global wildcard topics, such as `meari/#`, allowing the user to receive telemetry from devices they do not own. While the broker enforces publish Access Control Lists (ACLs), it fails to enforce equivalent subscribe authorization at the per-device scope. In a real-world test on a single broker, this allowed the capture of 14,204 messages from 2,117 devices. **Recommendations** Update EMQX versions 4.x to a version where subscribe authorization is properly enforced at the per-device scope.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 build 220 Arenti version 1.8.1 build 220 Meari-based white-label applications versions 1.8.x and earlier **Description** Meari client applications embedding "com.meari.sdk" contain a server-side authorization failure. An attacker can abuse the integrated call path to 'openapi-euce.mearicloud.com' to retrieve the WAN IP address of arbitrary devices using their serial number. This is possible because the 'GET /openapi/device/status' endpoint does not require user authentication and utilizes a hardcoded signing key present in all public Meari-based applications. This issue is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Meari IoT Cloud (affected versions not specified) **Description** Motion snapshots stored on Alibaba OSS are retrievable without authentication, signed URLs, or expiry enforcement. The system uploads JPEG images to the storage service when motion is detected and broadcasts the URL via the MQTT stream. These URLs act as direct object references and remain valid indefinitely, allowing anyone to access the images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label Android apps versions 1.x and earlier **Description** Meari IoT SDK builds contain multiple security-critical secrets that are hardcoded and shared across the ecosystem. These include API signing material, password-transport keying, and service access keys. Specifically, every Meari-based app utilizes the same HMAC secret (a key used for Hash-based Message Authentication Codes to verify data integrity), the same DES key (Data Encryption Standard) for passwords, the same OpenAPI key, and the same P2P password. These keys cannot be rotated without re-flashing every device in the field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (5.0, Medium). This issue was fixed in version v4.0.260416.0 of the runZero Platform.

**Name of the Vulnerable Software and Affected Versions** Abilis CPX (affected versions not specified) **Description** An attacker can gain access to a restricted shell on an unconfigured Abilis CPX device by repeatedly failing to authenticate via SSH. Specifically, after three unsuccessful authentication attempts, a fourth attempt allows login and enables connection relaying. This occurs because the device does not properly handle repeated failed login attempts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions Brother MFC-L2710DW printers (affected versions not specified) Description A flaw exists in the firmware of Brother MFC-L2710DW printers that can lead to information disclosure regarding files and directories. Successful exploitation may allow a remote attacker to gain unauthorized access to protected information. The vulnerability involves the 'uscan' protocol from the eSCL specification, potentially revealing the serial number of the printer. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MGT-COMMERCE CloudPanel version 2.2.0 **Description** The issue is related to the use of a static SSL certificate with a hardcoded cryptographic key in MGT-COMMERCE CloudPanel, which is shared across every installation. This could allow a remote attacker to gain unauthorized access to protected information. The behavior was observed in version 2.2.0, and there is no indication that it has been addressed in version 2.2.1. **Recommendations** For version 2.2.0, consider disabling the use of the static SSL certificate until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.