A server‑side authorization failure in the "GET /openapi/device/status" endpoint allows an attacker to retrieve the WAN IP address and other status data for any device managed by the Meari client applications. The flaw exposes network information that could be used to map internal networks or locate devices. The vulnerability falls under CWE‑862, reflecting a missing access control check that permits an unauthorized user to obtain protected information.

The flaw is present in Meari client applications that embed the "com.meari.sdk" library, including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and all related white‑label implementations through version 1.8.x. These affected systems expose the vulnerable API endpoint to external network traffic.

The CVSS score of 7.5 indicates a high‑severity information‑disclosure risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been actively exploited in the wild as of the latest data. Exploitation requires only the ability to send a crafted HTTP request to the openapi‑euce.mearicloud.com endpoint and supply a valid device identifier; no authentication or privileged credentials are required. The attack vector is remote access over the network.