CVE-2026-33359: Meari unauthenticated alert image access in cloud object storage
In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33359?
CVE-2026-33359 is rated as a critical vulnerability due to the potential unauthorized access to sensitive alert images.
How do I fix CVE-2026-33359?
To mitigate CVE-2026-33359, enable authentication and configure access control mechanisms for your cloud image storage.
Which software versions are affected by CVE-2026-33359?
CVE-2026-33359 affects the Meari IoT Cloud service on Alibaba OSS for the latest observed versions.
What impacts does CVE-2026-33359 have?
CVE-2026-33359 allows unauthorized users to access and retrieve motion snapshots without any authentication, leading to privacy breaches.
Is there a patch available for CVE-2026-33359?
Currently, there is no specific patch released for CVE-2026-33359, so it is crucial to implement recommended access controls.