The vulnerability resides in Meari IoT Cloud’s handling of alert image storage on Alibaba OSS. An unauthenticated user can retrieve motion snapshot images through direct URL references that lack authentication checks, signed URL enforcement, or expiration enforcement. This results in a breach of confidentiality, allowing attackers to view private video content without authorization, thereby violating privacy and potentially providing sensitive situational data to malicious actors. The weakness is classified as CWE‑862, indicating a missing authorization check.

Affected systems include Meari IoT Cloud services that utilize Alibaba OSS for storing alert images. No specific versioning information for the storage service is disclosed, but the issue was observed in the latest configuration available at the time of discovery.

The CVSS score of 7.5 signals a high severity vulnerability, and while the EPSS score is not available, the lack of authentication requirements and persistent URLs suggest a high likelihood of exploitation by remote actors. The vulnerability is not currently listed in the CISA KEV catalog. The attack vector is inferred to be remote, requiring only an HTTP request to a public URL, which an attacker can discover or brute‑force. By exploiting this flaw, an adversary could systematically harvest motion snapshots, gaining insight into users’ environments and potentially orchestrating further attacks.