One Wildcard to Watch Them All: Meari's IoT Cloud and the White-Label Trust Deficit

A colleague of researcher Sammy Azdoufal recently bought a baby monitor on Amazon and, like any sensible person, asked whether it was actually safe. The answer, delivered at DEF CON 34, was not a comforting firmware patch but a structural indictment. During a live audit of Meari Technology's cloud infrastructure, 14,204 messages from 2,117 distinct cameras streamed through a single wildcard subscription in just five minutes. Chaos is data in disguise. What looks like a random privacy breach is actually an architectural statement: this is what happens when 1.1 million devices share one access boundary. Meari is not a company most consumers have heard of, and that is precisely the point. Based in Hangzhou, it is an original design manufacturer that builds the entire stack — firmware, cloud backend, mobile applications — and hands it to more than 300 white-label brands. If you have bought a camera from Arenti, BOIFUN, COCOCAM, PetTec, SV3C, Joystek, Luvion, or Vimar, you are not running a niche product; you are running Meari's infrastructure. The scale is not a rounding error: 1.1 million registered devices across 118 countries. And the capital market has noticed. Meari went public on the Shenzhen ChiNext board in March 2025, and its share price doubled within two days. Follow the liquidity, ignore the hype. The market was not pricing in privacy; it was pricing in distribution. This is the first thing that should make every security professional pause: the entity that controls 1.1 million cameras and 118 countries of video telemetry is not a household name. It is an ODM that sells through 300 brands, which means the ordinary consumer has no contractual relationship with the party that actually holds the footage. The buyer of an Arenti camera believes they are buying from Arenti. In operational terms, Meari is the custodian of the feed. That gap between the brand on the box and the architecture behind it is where accountability goes to die. At DEF CON 34, the audit's title said it better than any news headline: '1.1 Million Cameras, One Wildcard: Architectural Surveillance in an IoT Cloud.' The full weight of that title sits on CVE-2026-33356. The MQTT broker, the messaging backbone that carries device telemetry, lacks per-device subscribe access control lists. In a properly designed system, each camera would have its own topic and its own authorization token; a breach of one device would not expose another. In Meari's system, any authenticated CloudEdge account can subscribe to the meari/# wildcard and, with that single subscription, watch every camera on the platform in real time. The word wildcard is doing real engineering work: it means the platform was not designed to distinguish between one camera and another at the authorization layer. It was designed as a single audience for a single broadcast. This is not an exotic vulnerability in an obscure endpoint. It is a structural feature of a cost-optimized architecture. MQTT is a lightweight publish-subscribe protocol, and in an ODM world, the fastest way to bring 300 brands onto one platform is to give everyone a key to the same building. The problem is that the key does not open a room; it opens the lobby, the hallway, and every room attached to it. During the research, 14,204 messages were captured from 2,117 distinct devices in five minutes. That is not a proof of concept; it is a sample of what an attacker with an authenticated account can do on a slow afternoon. The algorithm has no conscience. It executes the wildcard because the wildcard is what the architecture permits. And we are now wiring these compromised feeds into the most intimate layer of our digital lives. Cameras are being integrated with AI agents — Alexa, Google Home, Home Assistant — so the camera is the visual cortex of an artificial assistant. When the camera feed is compromised, the AI agent inherits that surveillance exposure. Trust breaks at the vision layer. The helpful assistant becomes an uninvited guest, and the ODM's cloud becomes the third party in every living room. Your AI agent's memory is only as trustworthy as its sensors. If the vision layer is corrupted, every downstream decision is corrupted. That is the difference between a privacy incident and a security breach: the former exposes data, the latter changes behavior. The financial context makes the security failure harder to excuse and easier to explain. The global baby monitor market is worth $1.87 billion, with the U.S. alone accounting for about $540 million. Those are not abstract numbers; they are the price of a product category built on an unexamined assumption that a brand on the box means security. Retailers continue to sell products that are architecturally incapable of protecting user privacy. Meari's public listing doubled in two days in March 2025, proving that the capital market rewards distribution scale, not access control design. I have spent years auditing token projects in which a supposedly decentralized protocol turned out to have a single admin key or a multisig with two signatures held by the same legal entity. The labels are different, but the forensic signature is the same: centralization always manages to call itself by another name. Meari is not a blockchain project, but it follows the same playbook — narrative precedes audit, growth precedes accountability, and security is treated as a deductible expense rather than a balance-sheet asset. In the crypto industry, we have a word for this: misalignment. The holder of the private key is the counterparty with ultimate control, and the protocol's token price is no guarantee of honest behavior. Meari is a centralized custodian of intimate video data, and its share price is a derivative of trust; it doubled because the market believed more devices would be sold, not because the access control model was sound. No one priced in the probability of a mass surveillance incident. This is exactly the kind of tail risk that DeFi investors learned to underwrite only after the collapses of 2022. Smart home investors have not yet had their lesson. Every competent security response will now say the obvious: patch the ACL, add per-device tokens, notify affected users. It is the right technical advice, and it is almost entirely insufficient. The more uncomfortable truth is that Meari has already given its answer: the affected products are, in the company's words, obsolete. There has been no confirmed direct user notification under GDPR Article 34, and the MQTT broker keeps streaming. The 70-day disclosure window coordinated by Tod Beardsley of runZero was a professional gesture, but it did not produce a repair. It produced a category change. Calling a product obsolete does not remove the access; it removes the responsibility. That is the same move I have seen in crypto exchanges that quietly terminate a service instead of reimbursing a compromised account, or in DAOs that call a treasury hack a governance event rather than a theft. The most damning part is not the vulnerability; it is the non-response. A researcher who finds a flaw in a blockchain bridge will usually publish, work with a bug bounty, and receive a patch. Here, the manufacturer called the product obsolete. That response is a governance failure. It tells every future researcher that disclosure is a thankless task; it tells every user that their privacy is not a supported feature. And it tells every regulator that the current regime has no teeth. The contrarian conclusion is not that we should stop buying baby monitors. It is that the white-label model is the vulnerability. The retailer sees a brand; the user sees a promise; and the ODM sees a distribution channel. The 300 brands are not customers in the traditional sense. They are front doors leading to the same data center. When a vulnerability is found, the incentives are not aligned. A retailer that discloses loses $540 million of U.S. revenue. An ODM that patches loses the cost advantage that made it attractive to 300 brands. The user is the only counterparty whose incentive is security, and the user is the one without a seat at the design table. This is a different beast than the Zbtlink ENDLESSDOORS vulnerability, which attacked the infrastructure layer directly. Meari is an architecture-level failure: the infrastructure is not broken; it was built to be broad. The problem is not an errant line of code; it is an economic model. The idea that we just need better regulation is also incomplete. Patching per-device ACLs would solve CVE-2026-33356, but it would not solve the business model. The ODM can always label a product obsolete and move on to the next SKU. Regulation that imposes a duty of care on the white-label brand, not just the manufacturer, is the only legal lever with teeth. But a duty of care is expensive; it requires continuous audits, software update commitments, and an honest end-of-life process. None of those things generate the kind of returns that made Meari's share price double in two days. What would a secure design look like? Each device would have a unique identity provisioned at manufacture, a key that never leaves the secure element. Each subscription would be scoped to that identity. The broker would enforce access control lists at the topic level; an account representing one user would need a distinct grant for each device, and a wildcard grant would be impossible by default. Those are not exotic requirements; they are baseline in enterprise messaging systems. The fact that a consumer IoT platform shipped without them tells you what the industry thinks of the people who buy the cameras. That is why local-first alternatives like Home Assistant are becoming more than hobbies: they are an architectural response to a market failure, and privacy is their competitive moat. Volatility is the price of admission. That phrase is familiar to anyone in digital assets, but it applies just as precisely to smart home trust. We have been buying a commodity — a camera — and paying for it with a surveillance option on the entire home. The question that should haunt every investor, consumer, and regulator is not whether Meari will patch CVE-2026-33356. It is whether we are willing to demand, at the point of sale, that a camera's authorization model be as auditable as its power supply. Who will be the first regulator to make per-device access control a condition for putting a camera on a shelf? Or will we wait until those 1.1 million devices are watching someone who sits in the room where policy is made? The wildcard is not a bug. It is a warning.