Meari Security Flaw Exposes 1 Million White-Label Amazon Cameras 2026

A critical security flaw in Meari cameras, including white-label baby monitors sold on Amazon, has exposed over one million devices to unauthorized access. The vulnerability, discovered by independent security researcher Sammy Azdoufal, affects cameras sold under brands like Arenti, Anran, Boifun, ieGeek, Wyze, Petcube, COCOCAM, PetTec, SV3C, Joystek, Luvion, and Vimar.

What Happened: Meari Camera Flaw Exposes 1 Million Devices

Sammy Azdoufal, a security expert and independent researcher, found that Meari cameras—including video doorbells and baby monitors—were completely unprotected. By analyzing the Android app, Azdoufal extracted a single key that granted access to more than one million cameras across 118 countries. His full investigation is detailed in his GitHub repository.

The flaw wasn't limited to a specific model but affected the entire architecture. Many of these brands share the same backend infrastructure, meaning a single vulnerability could compromise devices from multiple manufacturers. This is a classic example of how white-label products can inherit systemic risks.

Why This Matters: The Risks of White-Label Security

White-label products are manufactured by one company and sold under various brand names. While this practice is common and often cost-effective, it can obscure accountability and security practices. In this case, Meari Technologies, the manufacturer behind these cameras, apparently failed to implement basic security measures.

For consumers, the implications are severe. A compromised baby monitor or security camera can allow strangers to watch live feeds, invade privacy, and potentially gather sensitive information about your home and family. The fact that over a million devices are affected underscores the scale of the problem.

How to Check if Your Camera Is Affected

If you own a camera from any of the brands listed above, it's likely manufactured by Meari. Check the packaging or the device itself for the manufacturer's name. You can also look for the Meari app or similar backend services in the device's documentation.

To verify if your specific model is vulnerable, consult Azdoufal's GitHub repository, which lists affected devices and provides technical details. If your camera is listed, assume it is compromised until a patch is released.

What to Do If You Own an Affected Camera

If you have an affected camera, take immediate action to protect your privacy. First, disconnect the camera from the internet if possible. This will prevent remote access, though it may disable remote viewing features.

Next, check for firmware updates from the manufacturer. Meari and the brands it supplies may release patches. However, given the systemic nature of the flaw, updates may be slow or nonexistent. Consider replacing the device with a model from a reputable brand with a strong security track record.

Additionally, secure your home network by using strong, unique passwords and enabling two-factor authentication where available. Segment your IoT devices on a separate network to limit potential damage from compromised devices.

The Bigger Picture: IoT Security and Accountability

This incident highlights the ongoing challenges in IoT security, particularly with low-cost, white-label devices. Manufacturers often prioritize cost over security, and consumers may not realize the risks until it's too late. The background to this story is set out in Passkeys Security Flaw: New Research Exposes Passwordless Risk. A related thread runs through Best Supermarket Salmorejo: OCU Reveals White-Label Winners. Earlier coverage in Katy Perry Blasts White House Over Unauthorized Use of Firework shows how the argument developed.

Regulators are starting to pay attention. In the US, the FTC has taken action against companies with lax security practices. In the EU, the Cyber Resilience Act aims to impose stricter requirements on IoT devices. However, enforcement and consumer awareness remain limited. A closer look at the same subject appears in Katy Perry Condemns White House Over Unauthorized Use of Firework. Anyone following the wider picture can start with US Spaceport Laser Weapons to Counter Unauthorized Drones. The same theme surfaces in AI Exposes Old PHP Flaws, Raising Urgent Security Concerns, which takes a different angle.

As a consumer, you can advocate for better security by choosing products from companies that prioritize transparency and timely updates. Support organizations that push for stronger IoT regulations. Context on how this played out before sits in Dover Unrest Exposes Serious Flaws in UK Far-Right Extremism Strategy. A companion piece, How to Check if Your Website Is Affected by the PHP Vulnerability, approaches the same subject from another angle.

FAQ