CVE-2026-33356

Published May 11th, 2026

View on NVD ↗

CVSS v3

7.7

HIGH

CVSS v2

N/A

Affected

PROJECT

Description

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

xn0tsa/nobody-puts-baby-in-a-corner

Five CVEs against Meari/CloudEdge IoT camera platform — public disclosure 2026-05-11

GitHub