PT-2026-39644 · Meari · Meari Iot Sdk+2

Sammy Azdoufal + 1 · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-33362

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label Android apps versions 1.x and earlier

Description Meari IoT SDK builds contain multiple security-critical secrets that are hardcoded and shared across the ecosystem. These include API signing material, password-transport keying, and service access keys. Specifically, every Meari-based app utilizes the same HMAC secret (a key used for Hash-based Message Authentication Codes to verify data integrity), the same DES key (Data Encryption Standard) for passwords, the same OpenAPI key, and the same P2P password. These keys cannot be rotated without re-flashing every device in the field.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2026-33362

Affected Products

Arenti

Cloudedge

Meari Iot Sdk

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-33362 · Security Note
• https://github.com/xn0tsa/nobody-puts-baby-in-a-corner · Note
• https://runzero.com/advisories/meari-sdk-hardcoded-cryptographic-keys-cve-2026-33362 · Note
• https://twitter.com/CVEnew/status/2053932454671749485 · Twitter Post
• https://twitter.com/n0tsa/status/2053882992259391879 · Twitter Post