CVE Feed

    Dashboard / CVE / CVE-2025-65824

    CVE-2025-65824

    An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwritten with the attacker's code. As the device does not perform checks on upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.

    Published:Dec 10, 2025
    Last Modified:Jan 21, 2026
    EPS:Dec 10, 2025
    EPSS Score:0.00135
    CVSS Score:8.8

    Affected Products

    Vendor
    Meatmeet
    Product
    Meatmeet
    Vendor
    Meatmeet
    Product
    Meatmeet Pro Wifi \& Bluetooth Meat Thermometer
    Vendor
    Meatmeet
    Product
    Meatmeet Pro Wifi \& Bluetooth Meat Thermometer Firmware

    Exploits

    https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-remote-code-execution-mdhttps://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Device/Remote-Code-Execution.md

    Related CVEs

    CVE-2025-65825 (CVSS 4.6) — The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Mea…
    CVE-2025-65828 (CVSS 6.5) — An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth …
    CVE-2025-65826 (CVSS 9.8) — The mobile application was found to contain stored credentials for the network it was developed on. If an atta…
    CVE-2025-65830 (CVSS 9.1) — Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a resu…
    CVE-2025-65831 (CVSS 7.5) — The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of …
    CVE-2025-65832 (CVSS 4.6) — The mobile application insecurely handles information stored within memory. By performing a memory dump on the…
    CVE-2025-65827 (CVSS 9.1) — The mobile application is configured to allow clear text traffic to all domains and communicates with an API s…
    CVE-2025-65820 (CVSS 9.8) — An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned wi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High