It sits on the crib rail every night, pointed at a sleeping baby, reassuring parents that someone is always watching.
That is exactly what the brochure promises: total peace of mind, live video from anywhere, motion alerts straight to your phone.
Millions of families bought that promise.
What a growing number of them are only now finding out is that anyone else could have been watching too.
The device that became America’s favorite nursery companion
The Wi-Fi baby monitor has become as standard in a new baby’s room as a white-noise machine.
Parents can check on a sleeping infant from the kitchen, the backyard, or a hotel room across the country.
The pitch is simple: one small camera, one app, complete visibility, total control.
Demand has followed. The U.S. baby monitor market is projected to grow significantly through the early 2030s.
Dozens of brands now compete for shelf space and app-store reviews, many of them sharing the same hardware underneath different labels, the vulnerabilities affected white-label IoT ecosystems used by more than 300 camera brands sold through marketplaces like Amazon.
What the app icon does not tell you about who built the camera
Most parents choose a monitor by brand name, star rating, and price.
Few realize that the brand printed on the box is often just a wrapper.
Meari is the contract manufacturer behind the hardware. The brand name on your box is a wrapper. The shared platform underneath every affected camera is the CloudEdge app and the Meari cloud services it talks to.
The named retail brands that ship Meari hardware include Arenti, ieGeek, Boifun, and Anran.
That means one shared flaw in the underlying platform travels across every one of those labels at once.
And for a long stretch of time, that is exactly what happened, though almost no family knew it.
How the alert system became a window left wide open
The CloudEdge app is designed to push motion alerts to a parent’s phone the moment a camera detects movement in the nursery.
It is a feature parents rely on heavily, especially at night.
But those alerts, and the images attached to them, were being handled in a way that invited strangers in rather than keeping them out.
Motion-triggered snapshots were uploaded to Alibaba Object Storage Service (OSS) servers without authentication, signed URLs, or expiration controls.
The broader camera category sits at the center of a worsening threat landscape. According to Forescout’s 2025 Threat Roundup, exploits against IoT devices increased from 16% to 19%, with IP cameras and NVRs the most frequent targets.
In 2025, that cadence averaged 820,000 malicious IoT hacking attempts per day, a 46% jump from the year before.
Still, most parents checking their app at midnight had no indication anything was wrong.
The researcher who found activity from 2,000 cameras in minutes
In May 2026, independent security researcher Sammy Azdoufal disclosed a set of vulnerabilities in Meari Technology’s camera platform that left approximately 1.1 million baby monitors and security cameras open to remote access across 118 countries.
According to reporting in The Verge, as many as 1.1 million Wi-Fi baby monitors and security cameras produced by Meari Technology were found susceptible to a serious security breach, making users’ video feeds, stored photos, email addresses, and location data easily accessible. Consumer Reports summarized the key steps families should take at Consumer Reports.
One of the more serious issues, CVE-2026-33356, involved missing per-device access controls on the platform’s MQTT broker. Any free CloudEdge account could allegedly subscribe to device notifications across the platform and monitor camera activity in real time.
Azdoufal said he observed thousands of device messages from more than 2,000 cameras within minutes from a single regional broker.
A second vulnerability exposed device information through an API endpoint that required no user authentication and relied on a hardcoded signing key present in all public Meari-based applications. An attacker could use it to retrieve device WAN IP addresses using only device serial numbers, data that could be used to estimate the owner’s physical location.
A family’s full-time working parents who set up a monitor to feel closer to their child from the office may have inadvertently given strangers the same view.
While the biggest security issue has since been resolved, according to a company statement made by Meari to The Verge, device owners are still at risk unless they update their monitors to firmware version 3.0.0 and higher.
What families can do right now and why the fix is not as simple as it sounds
It is unclear whether all devices will be able to be updated, so if you are not able to upgrade to a newer firmware version, your monitor could still be vulnerable to security risks.
That is the part the patch announcement glosses over.
Older hardware on the affected platform may never receive a firmware update, leaving families who bought a monitor two or three years ago in a difficult position.
If you open the app you use to view your camera and the app is called CloudEdge, you are on the affected platform regardless of the brand printed on the device.
Security experts recommend checking your monitor’s Settings or About menu and confirming the firmware reads 3.0.0 or above.
For devices that cannot be updated, an offline monitor with no app, no cloud, and no shared infrastructure removes the risk entirely.
The broader lesson here echoes what researchers studying financially stretched American families keep finding: households make trust-based purchasing decisions quickly, often without the technical information needed to evaluate what they are really buying.
A baby monitor is sold as protection.
Making sure it actually provides it turns out to require one more step the box never mentions.
