CVE-2026-33361

Published: May 11, 2026Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 44488dab-36db-4358-99f9-bc116477f914 (Secondary)

Description

In Meari IoT SDK image handling (libmrplayer.so) as observed in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white-label apps (<= 1.8.x), baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model.

Related CWEs

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References (2)

https://github.com/xn0tsa/nobody-puts-baby-in-a-corner

Source: 44488dab-36db-4358-99f9-bc116477f914

https://www.runzero.com/advisories/meari-weak-xor-obfuscation-cve-2026-33361/

Source: 44488dab-36db-4358-99f9-bc116477f914

Timeline

No history available yet.