Sammy Azdoufal didn't crack anything. He didn't brute-force a password or write custom exploit code. He opened the Android app for a baby monitor he'd purchased, inspected it, and extracted a single encryption key. That key gave him remote access to 1.1 million cameras across 118 countries.
He could see live feeds. Stored photos. Email addresses and GPS coordinates of users. And in the images that came back — children's bedrooms with Hello Kitty decorations, toddlers staring directly into lenses, family moments that should have been private.
"I can retrieve the picture without any passwords, no cracking, no hacking," Azdoufal told The Verge. "I just click on the URL and this image is showing."
One Company, 118 Brand Names
The cameras were all made by Meari Technology, a Chinese white-label manufacturer that produces network-connected devices sold under dozens of different brand names on Amazon and other major retail platforms. The same hardware, the same software architecture, the same vulnerability — rebranded and sold across a vast retail footprint that makes it nearly impossible for a consumer to know they're buying a Meari product at all.
The flaw wasn't subtle. Meari routed all video through its own servers rather than through a user's home network, and protected those servers with default passwords — "admin" and "public" — while storing user photos at publicly accessible URLs with no authentication required. This isn't a sophisticated architecture that failed in an unexpected way. It's a system built without serious consideration of who else might be watching.
Azdoufal tried to contact the company for months. Meari ignored him. When he eventually got through — "I talk to the boss, I have his number, I send a WeChat" — the company patched the primary vulnerability and paid him a €24,000 bug bounty. What it hasn't answered is the harder question: whether the 1.1 million existing devices can actually receive the firmware update that closes the hole.
Eight Out of Nine Cameras Fail
Meari isn't the exception. It's the rule.
Rapid7, a Boston-based cybersecurity firm, tested nine popular baby monitors and scored eight of them with an F on security. The failing devices came from a range of price points. Higher prices didn't correlate with better security — pricier models often just meant more features, and more features meant more attack surface. The research suggests that the market has not rewarded security as a priority, and manufacturers have responded accordingly.
The problem is structural. Baby monitors, home security cameras, smart doorbells, and similar devices are all part of the broader Internet of Things — a category of products that connects to networks but has historically been developed without the security standards applied to laptops, phones, or enterprise software. Many devices use default credentials that are never changed by users and never enforced by manufacturers. Many phone home to manufacturer servers whose security practices are entirely opaque to the people who bought the device.
A 2025 academic review of IoT security practices found that the gap between stated privacy policies and actual data handling in consumer IoT devices remains substantial — particularly for devices manufactured in markets with limited regulatory accountability.
What's Actually in Your Home Network
The Meari situation is alarming precisely because the devices in question are placed in the most intimate spaces in a household — nurseries, bedrooms — and are left running continuously, often for years. The assumption that a device purchased from a recognizable retail platform has met some baseline standard of privacy protection is, based on the available evidence, not reliably true.
The practical steps are modest but meaningful. Check whether your camera's manufacturer routes video through its own servers or directly between your devices — server-routing models carry significantly higher risk. Change any default credentials immediately. Treat any device with a cloud component as a device that may be accessible to parties beyond you. And for older monitors on your network, check whether firmware updates are available and whether the manufacturer has any disclosed vulnerability history.
None of this is satisfying advice. The reasonable expectation — that a baby monitor monitors your baby — turns out to require verification that most people have no reason to know they need to do.
