CVE-2026-33359

In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/xn0tsa/nobody-puts-baby-in-a-corner
https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) En el almacenamiento de imágenes de alerta de Meari IoT Cloud en Alibaba OSS (última observación; versión del servicio de almacenamiento no divulgada), las instantáneas de movimiento son recuperables sin autenticación, URLs firmadas o aplicación de caducidad. Las URLs funcionan como referencias directas a objetos y permanecen válidas más allá de las ventanas operativas esperadas.

Information

Published : 2026-05-11 17:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-33359

Mitre link : CVE-2026-33359

CVE.ORG link : CVE-2026-33359

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-33359", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "44488dab-36db-4358-99f9-bc116477f914"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33359", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T18:17:55.620113Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "44488dab-36db-4358-99f9-bc116477f914", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "44488dab-36db-4358-99f9-bc116477f914", "affectedData": [{"vendor": "Meari", "product": "Alibaba OSS Hosted", "versions": [{"status": "affected", "version": "April, 2026", "versionType": "date"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-11T17:16:30.843", "references": [{"url": "https://github.com/xn0tsa/nobody-puts-baby-in-a-corner", "source": "44488dab-36db-4358-99f9-bc116477f914"}, {"url": "https://www.runzero.com/advisories/meari-unauthenticated-alert-image-access-in-cloud-object-storage-cve-2026-33359/", "source": "44488dab-36db-4358-99f9-bc116477f914"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "44488dab-36db-4358-99f9-bc116477f914", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication, signed URLs, or expiry enforcement. URLs function as direct object references and remain valid beyond expected operational windows."}, {"lang": "es", "value": "En el almacenamiento de im\u00e1genes de alerta de Meari IoT Cloud en Alibaba OSS (\u00faltima observaci\u00f3n; versi\u00f3n del servicio de almacenamiento no divulgada), las instant\u00e1neas de movimiento son recuperables sin autenticaci\u00f3n, URLs firmadas o aplicaci\u00f3n de caducidad. Las URLs funcionan como referencias directas a objetos y permanecen v\u00e1lidas m\u00e1s all\u00e1 de las ventanas operativas esperadas."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "44488dab-36db-4358-99f9-bc116477f914"}