Meatmeet Pro Thermometer CVE-2025-65821
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain physical access to device
-
DeliveryConnect to ESP32 UART interface
-
ExploitEnter enabled UART download mode
-
ExecutionDump flash and read NVS
-
ImpactRecover Wi-Fi credentials / reflash malicious firmware
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture On-chip debug access control
|
| Exploitation Conditions | Exploitation requires physical access to the device so the attacker can attach to the ESP32's UART lines; the enabling condition is that UART download mode is left enabled on the shipped firmware (version 1.0.34.4), allowing flash read-out and reflashing. Limiting factors: the attacker must possess the hardware and have the capability to interface with UART/the download-mode bootloader - there is no remote or network path despite the input's AV:N labeling, and no authentication bypasses this because the debug interface itself lacks access control (CWE-1191). Confidentiality exposure is specifically Wi-Fi network details stored in the NVS partition. |
| Impact | The inputs conflict on the single most important metric. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N (7.5, network, unauthenticated), but the description states the flaw is that UART download mode remains enabled on the ESP32, which an adversary exploits to dump flash and reflash firmware - that is an interface requiring physical/hardware access, not network access. The AV:N labeling therefore appears incorrect; this should almost certainly be AV:P (physical) - verify with the vendor/NVD. Once reframed as a physical-access issue, the practical risk drops sharply: an attacker must hold the device and attach to its UART lines. EPSS is low (0.37%, 31st percentile), there is no CISA KEV listing (not confirmed actively exploited), and the vuln.today priority is 'this_week' rather than act_now/emergency. The two reference links are an independent researcher's writeup/gist, i.e. a public PoC reference that is not verified as working exploit code. Net assessment: a genuine confidentiality-and-integrity weakness (Wi-Fi credentials recoverable from NVS, device reflashable), but gated behind physical possession of a niche consumer product, so it is a real but low-urgency, high-effort-per-target issue rather than a widespread remote threat. The description also implies an integrity impact (attacker reflashes firmware) that the input vector's I:N does not capture. |
| Exploit ScenarioDerived | An attacker who obtains physical possession of a Meatmeet Pro thermometer connects to the ESP32's still-enabled UART download mode and dumps the device flash, reading the current and previous Wi-Fi network details out of the NVS partition. With the same access the attacker reflashes the device with modified firmware containing malicious changes. A public PoC reference exists; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Meatmeet Pro WiFi & Bluetooth meat thermometers running firmware 1.0.34.4 leave the ESP32 UART download mode enabled, so anyone who can physically reach the board's UART pads can read out the whole flash image - including the NVS partition holding current and previously joined Wi-Fi network details - and can reflash the device with attacker-controlled firmware. The published CVSS score of 7.5 uses a network vector (AV:N), but the actual attack path documented in the researcher write-ups requires hands-on hardware access and attachment to the ESP32 UART lines, so the realistic exposure is a physical-access confidentiality and integrity compromise rather than a remote one. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is 0.37% (31st percentile), consistent with a low-volume, hardware-gated issue.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available sources, and the disclosure does not document a vendor remediation or workaround; treating firmware 1.0.34.4 as unfixed is the safe assumption until Meatmeet publishes a build that disables or protects the download interface. Because the flaw is in the ROM/boot configuration rather than application code, the durable fix generally has to come from the manufacturer burning eFuses to disable UART download boot and enable secure boot with flash encryption - a one-way, irreversible step that must be done with correct key management or the unit is bricked, so it is a vendor-side action rather than an end-user one. Until such firmware exists, owners should treat deployed units as physically trusted only: keep thermometers in access-controlled areas, avoid leaving them in shared or public spaces, and assume that any device that has been out of custody may have had its flash read or replaced. Rotating the Wi-Fi credentials that were provisioned to the device, and avoiding reuse of those credentials on other equipment, limits the value of an NVS dump; note this does not stop reflashing. Network-side segmentation of IoT devices does not mitigate this issue, since exploitation never traverses the network.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The device is built on an Espressif ESP32 SoC whose ROM bootloader supports a UART download mode used for factory flashing and serial flashing with tools such as esptool. Because that interface is left reachable and lacks access control on shipped units, it matches CWE-1191 (On-Chip Debug and Test Interface With Improper Access Control): the debug/programming interface is neither disabled nor protected, giving a physically present attacker both read and write capability over the flash. Read-out exposes the NVS (Non-Volatile Storage) key-value partition, where the ESP-IDF Wi-Fi stack persists SSIDs and passphrases for the currently configured and previously used networks, so a dump leaks credentials that may be reused elsewhere. Write capability lets the attacker replace the application image with modified firmware that preserves normal thermometer behavior while adding malicious functionality. The submitted CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N does not reflect this mechanism - the attack cannot be carried out over the network, and it does affect integrity through reflashing - which is why the assessed vector is AV:P with C:H/I:H. The trigger is physical attachment to the UART lines and entry into download mode; no authentication step is involved because the interface itself is unprotected.
Know when Meatmeet Pro Wifi Bluetooth Meat Thermometer Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
UART download mode needs physical device access so AV:P; flash dump exposes Wi-Fi credentials (C:H) and attacker can reflash firmware (I:H); no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive information such as details about the current and previous Wi-Fi network from the NVS partition. Additionally, this allows the adversary to reflash the device with their own firmware which may contain malicious modifications.
Executive ViewAI
The Meatmeet Pro WiFi & Bluetooth meat thermometer (firmware 1.0.34.4) leaves its ESP32 UART download mode enabled, allowing anyone with physical access to the device to extract stored Wi-Fi credentials and reflash firmware. This affects only devices that an attacker can physically handle; the CVSS score overstates remote risk. Leadership should care because leaked Wi-Fi credentials could enable lateral movement into corporate networks if the thermometer is used in office or commercial settings, though the likelihood is low given the hardware access requirement.
No vendor-released patch identified at time of analysis. Interim mitigations include: physically securing devices to prevent unauthorized access to UART pads (e.g., locking enclosures, tamper-evident seals); connecting thermometers only to isolated guest Wi-Fi networks with no access to corporate resources; rotating Wi-Fi credentials if device physical security cannot be assured; and disabling or physically blocking UART access if feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware
Unauthenticated Bluetooth Low Energy (BLE) command execution against the Meatmeet Pro WiFi & Bluetooth Meat Thermometer
Hardcoded Wi-Fi credentials embedded in Meatmeet Pro WiFi & Bluetooth meat thermometer firmware version 1.0.34.4 (CWE-79
Physical access to a Meatmeet basestation running firmware 1.0.34.4 permits an attacker to flash modified ESP32 firmware
Firmware replacement via an exposed JTAG interface on the Meatmeet Pro Wi-Fi & Bluetooth meat thermometer (firmware 1.0.
Stored Wi-Fi credentials can be recovered from Meatmeet Pro Thermometer basestations by an unauthenticated attacker who
Exploit-DB