Hacker checks out Amazon baby monitor, finds mother of all security flaws

A security researcher has uncovered a sweeping set of flaws in baby monitors, many of which use white-label tech stacks from China and are then rebranded and sold to new parents on channels such as Amazon.

The vulnerabilities affect up to 1.1million internet-connected cameras built on a shared platform developed by Meari Technology, a major Chinese company based in Hangzhou that designs and manufactures video-centric smart IoT (Internet of Things) devices.

Some of the brands that Meari resells its tech to can be found on Amazon and elsewhere, including CloudEdge, Wyze, Intelbras, Arenti, and Petcube.

The most serious issue with these baby monitors is that they allow any user with a free account to receive data streams from other people’s cameras, according to French researcher Sammy Azdoufal.

Fresh from winning a $30K bug bounty after finding a flaw in DJI Romo that allowed him to remotely control a 7000-strong fleet of robot vacuum cleaners, a colleague of Azdoufal's, who had recently become a new parent, asked the ethical hacker to check out a baby monitor she’d bought on Amazon.

The researcher admits that this cannot be assessed by just looking at the product.

“The boxes don't tell the buyer which cloud platform they phone to, and the apps are interchangeable.”

So Azdoufal bought the same brand of monitor, CloudEdge, created a new account, and analyzed its network traffic.

He found the device relied on a technology stack operated by Merai, a China-based company that builds the hardware, firmware, cloud systems, and mobile apps, which are then rebranded and sold globally.

He adds that hundreds of brands the same underlying system.

“They build the camera, the firmware, the cloud, and the mobile app, then sell the whole stack to brands who put their own logo on the box.”

"'Made in China by an ODM [original device manufacturer] nobody's heard of' describes 90% of the consumer baby-monitor market."

He adds that over 300+ partner brands ride the same backend, including consumer brands Wyze, Intelbras, Arenti, and Petcube.

The findings, now tracked by CISA, outline five high-risk vulnerabilities, which Azdoufal says reflect design problems rather than isolated bugs.

The most serious issue affects a system referred to as an MQTT broker, which sends alerts from cameras to users’ phones. According to the report, anyone with a free account could receive data from other people’s devices (CVE-2026-33359).

A second vulnerability exposes device information through a static OpenAPI key that requires no user authentication. By querying it with a device serial number, an attacker could retrieve the camera’s external IP address, and this data could be used to estimate the owner's physical location (CVE-2026-33357).

Other issues involved how images were stored and protected. Motion-triggered snapshots were uploaded to public Alibaba Cloud storage, for instance, where links were not signed, had no expiry, and required no login, making them accessible to anyone who obtained the URL (CVE-2026-33359).

According to Azdoufal, in the baby monitor models, these images were only lightly scrambled (using a reversible XOR method), allowing them to be reconstructed with publicly available information (CVE-2026-33361).

The researcher also found that all apps using the platform shared the same built-in cryptographic keys (CVE-2026-33362), which are hardcoded into the software – meaning they cannot easily be changed in the event of an attack.

These five high-risk CVEs add up to a platform built to harvest customer data at scale, Azdoufal says, “secured by defaults that nobody on the inside ever planned to rotate.”

Using publicly-available data, he estimates that the platform that ships these defaults operates 1.1 million registered devices across 118+ countries.

Not even Meari employees are protected, the research suggests, as Azdoufal reported exposed internal company servers containing over 600 employee credentials (including the CEO’s) and operational data tied to Meari’s infrastructure.

After initially dismissing the findings, Meari eventually shut down the vulnerable EMQX platform, rotated credentials, and released firmware updates for some affected devices.

After 47 days, the Hangzhou-based company signed off on the vulnerability disclosures.

It remains unclear how many cameras in use can still receive updates or whether affected customers have been notified. Consumers using CloudEdge devices or other brands built on Meari’s software platform may be affected.

Larry Pesce, vice president of services at Finite State, said the incident reflects a wider industry problem: white-boxed products and fragmented accountability.

“In these business models, margins are razor-thin, which often means security investment gets treated as a cost center instead of a product requirement.

“Everybody wants the feature set, the mobile app, the cloud connectivity, but nobody wants to pay for rigorous security engineering, long-term maintenance, or coordinated vulnerability response. But when something goes wrong, the responsibility chain becomes a maze."

"The reseller may have branded the device and sold it to consumers, but they frequently have little or no control over the underlying firmware, cloud platform, or update process,” he warned.

Unlock more exclusive Cybernews content on YouTube.