CVE-2026-33362 - Meari SDK hardcoded cryptographic keys

Back Back to CVE browser

HIGH

Meari SDK hardcoded cryptographic keys

Published May 11, 2026

8.6

HIGH

CVSS 3.1

EPSS 0.41%

Description

In Meari IoT SDK builds embedded in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and white-label Android apps <= 1.8.x (latest observed), multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.

Affected products

Vendor Meari Product Com.meari.sdk Default
unaffected
- Version
  firmID=8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Meari

Com.meari.sdk

unaffected

Version	Status	Constraints
firmID=8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-321

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29106
Advisory
https://github.com/xn0tsa/nobody-puts-baby-in-a-corner
technical-description
https://www.runzero.com/advisories/meari-sdk-hardcoded-cryptographic-keys-cve-2026-33362/
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29106		Advisory
https://github.com/xn0tsa/nobody-puts-baby-in-a-corner		technical-description
https://www.runzero.com/advisories/meari-sdk-hardcoded-cryptographic-keys-cve-2026-33362/		third-party-advisory