The vulnerability arises from hardcoded cryptographic keys embedded in the Meari IoT SDK. The exposed secrets include API signing material, a key used to secure password transport, and service access keys. This weakness falls under CWE‑321, which allows an attacker to forge authenticated requests, intercept secure credentials, and potentially gain unauthorized service access. Consequently, confidentiality and integrity of communications with Meari devices and their backend services may be compromised.

Affected products are the Meari SDK integrated into CloudEdge 5.5.0 (build 220) and Arenti 1.8.1 (build 220), as well as various white‑label Android applications distributed at version 1.8.x or earlier. These versions contain the hardcoded keys that are common across the product line.

With a CVSS score of 8.6, this issue is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local or via a compromised device: any party that can read the binary or otherwise access the device internals can extract the keys and use them to impersonate the device or eavesdrop on sensitive data. While the exploitation requirement is modest, the potential impact on confidentiality and authentication integrity is significant.