PT-2026-39643 · Meari+2 · Meari Iot Sdk+2

Sammy Azdoufal + 1 · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-33361

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label apps versions 1.8.x and earlier

Description In the Meari IoT SDK image handling within the libmrplayer.so library, baby monitor images using the ".jpgx3" extension are protected by a reversible XOR operation. This operation only affects the first 1024 bytes of the JPEG file and utilizes a predictable key derivation model based on the MD5 hash of the device serial, the length of the serial, and a secret. The serial number is transmitted within the same MQTT message, facilitating the decryption of the images.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2026-33361

Affected Products

Arenti

Cloudedge

Meari Iot Sdk

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-33361 · Security Note
• https://github.com/xn0tsa/nobody-puts-baby-in-a-corner · Note
• https://twitter.com/n0tsa/status/2053882990602690667 · Twitter Post
• https://runzero.com/advisories/meari-weak-xor-obfuscation-cve-2026-33361 · Note
• https://twitter.com/KaitanSecurity/status/2053897936774263207 · Twitter Post
• https://twitter.com/CVEnew/status/2053932455648964913 · Twitter Post