The vulnerability resides in the Meari IoT Cloud MQTT Broker, which runs EMQX 4.x. It allows any authenticated user with low privileges to subscribe to global wildcard topics. Because the broker enforces publishing restrictions but fails to enforce corresponding subscription restrictions for each device, an attacker can receive telemetry data from devices beyond their ownership. This represents a confidentiality breach: the attacker gains unintended access to sensitive device data without requiring elevated rights.

The affected product is the Meari IoT Cloud MQTT Broker built on EMQX 4.x. No specific version numbers are listed beyond the major EMQX 4.x series, so all deployments of that branch are potentially impacted. Users of Meari’s cloud services who rely on EMQX for MQTT messaging should confirm whether they run the 4.x branch and whether per-device ACL restrictions are in place.

With a CVSS score of 7.7, the vulnerability is considered high severity. The EPSS is not available, so the exploitation probability is unknown, but the issue is not catalogued in CISA KEV, indicating no confirmed public exploitation yet. The likely attack vector involves an authenticated low‑privilege user performing a simple MQTT SUBSCRIBE command with a wildcard topic. If the broker’s ACL configuration does not restrict such subscriptions, the attacker will receive all telemetry data for all devices, providing a clear pathway to data breach without needing additional access or credentials.