The camera pointed at a sleeping child is the most sensitive device most households will ever install. It is also, very often, the cheapest — a $40 unit from a brand name nobody recognizes, ordered from a marketplace listing, set up in four minutes.

Those two facts collided in a disclosure that reached roughly 1.1 million baby monitors and security cameras across 118 countries.

What the Researcher Found

Security researcher Sammy Azdoufal disclosed a set of vulnerabilities in the camera platform operated by Meari Technology, whose hardware, apps, SDKs, and cloud infrastructure sit behind the CloudEdge app. Two of the flaws carry CVEs, both rated CVSS 7.5 (High), and both are notable less for their sophistication than for their simplicity.

CVE-2026-33359 — unauthenticated motion-alert images. When a camera detects motion, it uploads a still to a cloud bucket so you can see it in the notification. Meari stored those images on Alibaba Object Storage Service with no authentication, no signed URLs, and no expiration. The links were embedded in MQTT messages and remained publicly accessible indefinitely. Photographs from inside homes and nurseries, sitting at fetchable URLs, forever.

CVE-2026-33357 — device information disclosure via a static API key. A static OpenAPI key requiring no user authentication meant that querying with a device serial number returned information about that camera, including its external IP address — enough to estimate the owner’s physical location.

And underpinning both, the structural failure: the platform’s message broker had no per-device access controls. A free account created in Meari’s own CloudEdge app could subscribe to the notification stream of every other camera on the platform. No exploit, no hardware teardown, no decompilation. Sign up, subscribe, receive other people’s alerts.

Azdoufal also documented exposed backend systems, weak encryption, and hardcoded credentials across Meari’s applications and SDKs. Five CVEs were filed in total, publicly disclosed on May 11, 2026.

Why This Reached 300 Brands You’ve Never Heard Of

Here is the part that makes this bigger than one manufacturer.

Meari does not primarily sell cameras under its own name. It supplies hardware, firmware, apps, and cloud backend to more than 300 white-label brands that sell through Amazon and other marketplaces — names like Arenti, ieGeek, Boifun, and Anran among them. Different logos, different listings, different prices, different review counts. One platform underneath.

This is how the consumer camera market actually works, and almost no buyer knows it. You compare four baby monitors, read the reviews, pick the one with the better night vision and the friendlier app screenshots — and all four are the same device with different stickers, talking to the same cloud, sharing the same flaws.

It also means the ordinary consumer defenses fail completely:

  • Brand research doesn’t help. You cannot research your way to safety when the brand is a marketing wrapper.
  • Reviews don’t help. Thousands of five-star reviews describe the picture quality, not the MQTT authorization model.
  • A vendor advisory doesn’t reach you. If Meari publishes something, you were never a Meari customer — you bought a Boifun.
  • You can’t tell if you’re affected. The name on your camera does not appear in the disclosure.

If you own an inexpensive Wi-Fi camera or baby monitor that pairs through an app called CloudEdge, or an app that looks and behaves like it, you should assume you are on this platform. That app name is the reliable tell, not the box.

The Vendor Response

The disclosure timeline is its own story. Meari ignored the vulnerability reports for months. The company only engaged after Azdoufal escalated to the point of accessing their employee database — a demonstration that the exposure ran deeper than the camera fleet.

Meari then paid a €24,000 bug bounty, which is a genuinely substantial sum and more than many far larger companies would have paid. Credit where it is due.

But the question that matters for owners is the one that remains open: can the affected devices actually receive firmware updates? For a fleet of 1.1 million budget cameras spread across 300 brands, sold years ago by sellers who may no longer exist, distributed through marketplaces with no update channel — the honest answer for a large share of that fleet is no. Server-side fixes protect everyone at once, which is the good news for the storage and broker flaws. Anything requiring new firmware on the device will reach a fraction of the affected units, and nobody knows what fraction.

What To Do If You Own One

Treat this as an urgent replacement, not a maintenance item — if it is pointed at a child. That is a real cost and we don’t suggest it lightly. But a nursery camera on a platform where a free account could subscribe to strangers’ motion alerts is not a device to keep for sentimental or budget reasons.

In the meantime, cut its internet access. Both CVEs and the broker flaw are cloud-side exposures. A camera blocked from the internet at your router cannot upload alert images to an unauthenticated bucket and cannot be looked up by serial number. You lose remote viewing. You keep the camera doing the thing it’s actually for, in the room it’s in.

Delete the cloud account and the stored history. Whatever motion images already uploaded are already there. Request deletion, revoke the account, and understand you have no way to verify the deletion happened.

Isolate it on an IoT VLAN with no route to your laptops, phones, or NAS — and give it a network password that opens nothing else. This is the control that limits every future flaw in every appliance you own, and it is why we keep returning to the complete guide to securing your smart home network.

Check the app, not the brand, on your next purchase. Search the app name plus “vulnerability” before you buy. It is the only reliable way to identify what platform a white-label camera actually runs on.

Prefer local-first cameras. A camera that records to a microSD card or a local hub and works with the internet unplugged has a dramatically smaller failure surface — there is no cloud bucket to misconfigure and no shared broker to subscribe to. The arrival of standardized camera support in Matter makes this an increasingly realistic thing to ask for.

The Pattern, Again

Three separate disclosures this year — Shark’s vacuums, Naxclow’s doorbells and Yarbo’s robots, and now Meari’s cameras — and the same root cause in each: a cloud message broker with no per-device authorization, so that one credential, or in Meari’s case one free signup, reaches the whole fleet.

The device in your nursery is a camera and a Wi-Fi radio. The security of the thing is almost entirely a property of a cloud platform you did not choose, cannot inspect, and in this case had probably never heard of. Everything a buyer can evaluate — resolution, night vision, app design, price, reviews — is orthogonal to whether that platform got the authorization model right.

Until that changes, the only durable defenses are the ones that don’t depend on the vendor being competent: keep it local, keep it segmented, and prefer devices that still work when you unplug the cloud.

Bottom Line

A free account on the manufacturer’s own app was enough to receive motion alerts from a million other people’s cameras, and the images those alerts pointed to needed no credentials at all. It was found by one researcher, ignored for months, and eventually paid out at €24,000.

If there is a cheap Wi-Fi camera watching your child tonight, go find out what app it pairs with. That name, not the one on the box, is what determines who else can see it.

Sources