Meari’s image handling component, libmrplayer.so, applies a reversible XOR cipher to the first 1024 bytes of baby‑monitor JPEG files using a predictable key derivation model. The weakness lies in the limited scope of encryption and the deterministic key, allowing an attacker to recover the original image content. This flaw is classified as CWE‑326, representing insecure encryption practices. The CVSS score of 7.5 indicates a medium‑high severity, reflecting significant potential for privacy violations.

The vulnerability is present in the Meari SDK (com.meari.sdk) used in CloudEdge 5.5.0 (build 220), Arenti 1.8.1 (build 220), and related white‑label baby‑monitor applications up to version 1.8.x.

Because the XOR obfuscation applies only to the first 1024 bytes and the key is easily derivable, an attacker who can obtain or intercept the obfuscated image files can reconstruct the original image. The CVSS score of 7.5 highlights the risk, but the EPSS score is unavailable, making current exploitation likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the most likely attack vector is interception or direct access to the device’s stored or transmitted image data, from which the weak encryption can be reversed.