The vulnerability CVE-2026-33357 affects Meari client applications embedding the com.meari.sdk, such as CloudEdge 5.5.0 build 220 and Arenti 1.8.1 build 220. The root cause is a missing authorization control on the server side for the GET /openapi/device/status endpoint on openapi-euce.mearicloud.com. This flaw allows unauthenticated attackers to retrieve WAN IP addresses of arbitrary devices, potentially exposing sensitive network information. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with no required privileges or user interaction for exploitation. The vulnerability is classified under CWE-862 (Missing Authorization). There is no vendor advisory or patch currently available, and the product is not a cloud service, so remediation is not managed by the vendor.

Successful exploitation of this vulnerability allows an attacker to obtain WAN IP address information of arbitrary devices using the affected Meari SDK. This compromises confidentiality by exposing sensitive network information, which could facilitate further targeted attacks or reconnaissance. There is no impact on integrity or availability reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should monitor vendor communications for updates. Until a patch is released, restricting access to the affected API endpoint or network-level controls may help reduce exposure, but no vendor-endorsed mitigations are documented.