{"id":"CVE-2026-101104","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-101104","generatedAt":"2026-10-27T22:46:42.938Z","title":"The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own.","description":"The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as altering device settings or triggering unintended behaviors, without verifying ownership or permissions.","published":"2026-10-02T16:16:43.000Z","lastModified":"2026-10-03T16:16:31.000Z","status":"Deferred","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"4.0","score":6.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-862"],"affected":[],"epss":{"score":0.00268,"percentile":0.18794,"date":"2026-10-26","history":[{"date":"2026-10-03","score":0.00268,"percentile":0.1723}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.27%). Track it; it rarely justifies an emergency change on its own."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-02T16:16:43.000Z","detail":{"score":"6.3","severity":"MEDIUM","publishedAt":"2026-10-02T16:16:42.883Z"},"summary":"New CVE, medium severity (CVSS 6.3)."}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-274-06.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-274-06","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.meari.com/en/downLoadCenter","source":"ics-cert@hq.dhs.gov"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-101104","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}