Tod Beardsley

**Name of the Vulnerable Software and Affected Versions** FatFS versions R0.16 and earlier **Description** An integer overflow occurs in the `mount volume()` function during FAT32 processing when the operation `fasize *= fs->n fats` wraps. This allows an attacker to control file-size metadata, resulting in unsafe read lengths for downstream callers. This issue can be exploited via crafted FAT images on USB sticks or SD cards to achieve arbitrary code execution on embedded devices, including those using ESP-IDF, STM32Cube, Zephyr, and ArduPilot. Additionally, remote delivery is possible through OTA or update pipelines. Real-world exploitation has been demonstrated on a camera device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FatFs versions R0.16 and earlier **Description** An issue exists in the handling of long filenames when LFN (Long File Name) is enabled. The `fno.fname` variable can reach up to 255 characters, and many callers copy this data into short fixed buffers without performing bounds checks, leading to a buffer overflow. A buffer overflow occurs when a program writes more data to a block of memory than it is allocated to hold. **Recommendations** Update FatFs to a version later than R0.16. Ensure that the size of the file name buffer is sufficient to hold up to 255 characters when copying `fno.fname`.

**Name of the Vulnerable Software and Affected Versions** FatFs versions R0.16 and earlier **Description** A stack-based buffer overflow occurs in the `f getlabel()` function. This issue arises because the exFAT label length `XDIR NumLabel` is trusted without enforcing the maximum limits defined by the specification. **Recommendations** As a temporary workaround, consider restricting the use of the `f getlabel()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** FatFs versions R0.16 and earlier **Description** An uninitialized cluster exposure occurs when the `f lseek()` function extends files beyond the end-of-file (EOF) without zero-filling newly allocated clusters. This issue is a Use of Uninitialized Resource, where the system fails to clear memory or storage before use, potentially exposing sensitive data previously stored in those clusters. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FatFs versions R0.16 and earlier **Description** An integer underflow occurs during interleaved read and write operations on fragmented filesystems. This issue is caused by an unsigned-subtraction wrap in the `f read()` and `f write()` functions when evaluating the condition `fp->sect - sect < cc`, which leads to a stale dirty-cache skip. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FatFs versions prior to R0.16 **Description** An issue exists when using GPT scanning with `FF LBA64 = 1` where an unbounded loop count is derived from the GPT header field `GPTH PtNum`. This can lead to extremely long or effectively infinite scans during the mount-time process, resulting in a loop with an unreachable exit condition. **Recommendations** Update FatFs to version R0.16 or later.

**Name of the Vulnerable Software and Affected Versions** FatFs versions R0.16 and earlier **Description** A divide-by-zero issue exists in the exFAT sync logic. This occurs during write or sync operations when crafted metadata causes the calculation `n fatent - 2` to result in zero. Divide-by-zero is a condition where a program attempts to divide a number by zero, which typically leads to a system crash or application failure. **Recommendations** Update FatFs to a version later than R0.16.

**Name of the Vulnerable Software and Affected Versions** ServerCo getssl versions prior to 2.49 **Description** Insufficient validation of the ACME challenge token against RFC 8555 during challenge-file handling allows a maliciously crafted token to influence local path or filename usage. An attacker capable of supplying ACME challenge responses—such as through a compromised CA endpoint or by tampering with the response path—can achieve unauthorized file write and path traversal effects. This typically occurs with elevated privileges and can lead to remote command injection. This is an instance of External Control of File Name or Path, where an external input determines the path used by the application. **Recommendations** Update ServerCo getssl to a version newer than 2.49.

The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 Critical). When combined with CVE-2026-50082, CVE-50084, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

🚨 CVE-2026-50082 The Aqara Cloud Developer Portal (developer.aqara.com) issued a developer token to any email address supplied by the attacker. This is an instance of "CWE-306: Missing Authentication for Critical Function" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium). When combined with CVE-2026-50083, CVE-2026-50084, and CVE-2026-50085, any otherwise-unauthenticated attacker could execute a full takeover of affected devices. 🎖@cveNotify

The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6 Critical). When combined with CVE-2026-50082, CVE-50083, and CVE-50085, this can lead to a fully unauthenticated, remote takeover of affected devices.

**Name of the Vulnerable Software and Affected Versions** Aqara Board service (affected versions not specified) **Description** The Aqara Board service at the endpoint "op-test.aqara.com" accepts arbitrary MQTT command payloads and forwards them to the platform's HiveMQ broker without authentication. This missing authentication for a critical function allows for unauthenticated MQTT command injection. When combined with other flaws, this can lead to a complete remote takeover of affected devices. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Monitor and isolate affected systems.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO gateway (affected versions not specified) **Description** The IAM/SSO gateway at 'gw-builder.aqara.com' exposes an unauthenticated AES oracle, allowing bidirectional AES round-trips against the platform's signing key. This occurs due to missing authentication for a critical function and the use of a broken or risky cryptographic algorithm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO gateway (affected versions not specified) **Description** The Aqara IAM/SSO gateway at 'gw-builder.aqara.com' contains a cross-origin resource sharing issue. This is a permissive cross-domain policy with untrusted domains, which allows a website to make requests to a different domain than the one that served the original page. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara Developer Portal (affected versions not specified) **Description** The Aqara Developer Portal (developer.aqara.com) and shared test environments (developer-test.aqara.com, aiot-test.aqara.com) exhibit permissive cross-origin request sharing. This is an instance of a permissive cross-domain policy with untrusted domains, which allows requests from unauthorized origins to access resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara IAM/SSO Gateway (affected versions not specified) **Description** The Aqara IAM/SSO Gateway at 'gw-builder.aqara.com' contains an open redirect. This issue allows the system to redirect users to untrusted external sites, which can be leveraged to facilitate phishing attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Aqara Cloud (affected versions not specified) **Description** The OAuth Authorization Endpoint "open-cn.aqara.com/oauth/authorize" is subject to a redirect bypass caused by improper validation of unsafe equivalence in input. This flaw allows for domain matching bypass, which can be leveraged to facilitate phishing attacks and session theft. **Recommendations** Disable OAuth integration until a fix is available.

**Name of the Vulnerable Software and Affected Versions** Aqara Home Android version 6.0.0 **Description** Aqara Home Android (com.lumiunited.aqarahome) and white-label clients embedding the `liblumidevsdk.so` library use hard-coded cryptographic keys. This occurs when a developer embeds a secret key directly into the source code, which can be extracted by an attacker to decrypt sensitive data or authenticate as a legitimate entity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label Android apps versions 1.x and earlier **Description** Meari IoT SDK builds contain multiple security-critical secrets that are hardcoded and shared across the ecosystem. These include API signing material, password-transport keying, and service access keys. Specifically, every Meari-based app utilizes the same HMAC secret (a key used for Hash-based Message Authentication Codes to verify data integrity), the same DES key (Data Encryption Standard) for passwords, the same OpenAPI key, and the same P2P password. These keys cannot be rotated without re-flashing every device in the field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CloudEdge version 5.5.0 (build 220) Arenti version 1.8.1 (build 220) White-label apps versions 1.8.x and earlier **Description** In the Meari IoT SDK image handling within the `libmrplayer.so` library, baby monitor images using the ".jpgx3" extension are protected by a reversible XOR operation. This operation only affects the first 1024 bytes of the JPEG file and utilizes a predictable key derivation model based on the MD5 hash of the device serial, the length of the serial, and a secret. The serial number is transmitted within the same MQTT message, facilitating the decryption of the images. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.