Hackers Expose Vulnerabilities in Over a Million Baby Monitors and Security Cameras

A baby’s eyes gaze directly into the camera. A kid in a striped shirt glances up, then looks away. A boy dressed as a policeman sports a shiny gold star on his chest. The messy bedroom scene evokes memories of my own daughters, with an unmade bunk bed, a little girl’s hat and headband, and Hello Kitty decorations on the wall.

One thought keeps echoing in my mind: I shouldn’t be seeing this. No one should.

Yet, malicious actors could have easily accessed these locations — and countless others — because many of Meari Technology’s Wi-Fi baby monitors and security cameras were alarmingly insecure. If you gained access to one of those cameras, you could potentially access them all.

Meari is a Chinese white-label brand whose cameras are sold under numerous names. Many of these are generic-sounding sellers on online marketplaces. Financial records indicate that one of the company’s largest clients is Wyze, with Zhiyun as another major customer, and many of the vulnerable cameras were from Intelbras. At least one of Petcube’s pet-monitoring cameras appears to be a Meari product as well.

Sammy Azdoufal, a French tech enthusiast who created a remote-controlled army of DJI Romo robot vacuums with minimal effort, discovered 1.1 million remotely accessible Meari cameras in a similar fashion. By examining the Android app, he extracted a single key that granted him access to devices across 118 countries.

Each of those million devices was broadcasting information to anyone who knew how to listen or guess the company’s passwords, many of which were still set to defaults. One of those passwords was simply “admin.” Another was “public.”

When Azdoufal connected the MQTT datastream to a vibe-coded world map, he could see “everything.” He could peer into people’s homes and access their email addresses and approximate locations.

He also stumbled upon tens of thousands of photos from these cameras, stored on Chinese Alibaba servers at public web addresses without any protection, including the images I mentioned earlier.

“I can retrieve the picture without any passwords, no cracking, no hacking,” Azdoufal stated. “I just click on the URL, and the image appears.”

Azdoufal even found an unprotected internal server containing Meari’s passwords and credentials, along with a list of all 678 employees, complete with their emails and phone numbers. “I can talk to the boss, I have his number, I send a WeChat,” he chuckled.

It was only then that Meari began responding to his emails. Despite reports of vulnerabilities in Meari’s CloudEdge platform dating back years, and a late 2025 vulnerability report predicting the potential damage from Meari’s MQTT design, the company didn’t take him seriously until its own employees were shown to be at risk.

On March 10th, Meari cut off Azdoufal’s access and closed the primary vulnerability. By the time I purchased three cameras from different Meari vendors hoping to witness the hack firsthand, I was (thankfully!) too late. However, I didn’t need to rely solely on Azdoufal’s word to understand the real potential for damage.

“Under specific technical conditions, attackers may intercept all messages transmitted via the EMQX IoT platform without user authorization,” an unnamed spokesperson from Meari’s security team admitted when contacted.

The company also acknowledged a “Risk of potential Remote Code Execution (RCE) due to weak password issues on the scheduled task platform.”

To address these issues, Meari’s spokesperson stated that the EMQX platform was shut down entirely, usernames and passwords were changed, and customers were advised to upgrade their devices to the latest firmware (claiming only versions below 3.0.0 were affected).

However, Meari did not disclose:
* The number of cameras or brands that were actually vulnerable;
* Whether those brands had adequately informed their customers;
* Whether these vulnerabilities had already been exploited;
* What measures, if any, prevent a Meari employee or vendor from spying on individuals from afar.

Azdoufal noted that Meari’s original system design allowed any brand to access any other brand’s cameras, as they all shared the same servers and passwords. While shutting down the EMQX platform blocked remote access, it remains unclear what will happen to those million cameras now. Meari has not clarified how many of those devices can receive a firmware update or whether its partners have warned customers about the vulnerabilities.

We reached out to some of Meari’s camera partners to gauge their awareness of the issue. Responses from several were not forthcoming. Intelbras, through a third-party spokesperson, claimed to have only worked with Meari on three Wi-Fi video doorbells, stating that “fewer than 50” units had a potential vulnerability. This figure contradicts Azdoufal’s findings, as Intelbras appeared to be one of the more prevalent brands in his dataset, particularly in Brazil. The spokesperson did not confirm whether Meari had communicated about the vulnerabilities or if Intelbras would alert its customers.

When we contacted Congress’s Select Committee on the Chinese Communist Party regarding Meari, a representative expressed concern over the reports, pledging to investigate further.

The silver lining is that Azdoufal reported most of the issues he uncovered seem to have been resolved, and on May 7th, he received a €24,000 bug bounty for his assistance. However, the experience left him with a sour taste.

After initially sharing his findings with Meari, the company sent him what he interpreted as a veiled threat, asserting that it was “fully capable of protecting our interests,” that they knew his location, and that his discovery of Meari’s internal servers was “unlawful.”

He was also displeased that Meari attempted to backdate its security bulletins to March 2nd, making it appear as though they had discovered the vulnerabilities before he reached out. Even now, the bulletins are dated March 12th, nearly a month before Meari published them in April. He also pointed out that Meari has yet to meet its GDPR obligations to notify EU citizens about the breach.

While I wish I could detail every alarming discovery Azdoufal made regarding Meari’s practices, more information can be found in his comprehensive security writeup. He also collaborated with another expert to file five official CVE vulnerability reports.

During my research for this story, I noticed a significant number of baby monitors on online marketplaces now advertise “No Wi-Fi.” While this doesn’t guarantee security, at least their short-range FHSS or DECT transmissions should be difficult to intercept from across the globe.