Meatmeet Pro CVE-2025-65823

Not remotely exploitable against a default deployment despite AV:N. Path 1 requires the attacker to reverse-engineer the firmware to obtain the hardcoded dev/test Wi-Fi credentials AND independently discover the physical location of that vendor Wi-Fi network to connect to it. Path 2 (evil-twin) requires close physical proximity to the specific device at the moment of first setup, plus standing up a rogue AP configured with the recovered SSID and password so the device auto-connects. Both are limited to Wi-Fi/adjacent range and are timing- or location-dependent; there is no purely-remote internet-facing exploitation of the device itself.

The 9.8 CRITICAL rating is grossly overstated relative to the actual described attack. The NVD vector claims AV:N/AC:L/PR:N/UI:N with full C:H/I:H/A:H, but the description itself limits both exploitation paths to proximity-bound Wi-Fi scenarios: either (1) extract hardcoded credentials from firmware AND physically locate the vendor's dev/test Wi-Fi network, or (2) be in close physical proximity to the device during first setup to run an evil-twin AP. Both are adjacent/physical (AV:A, not AV:N) and require additional non-trivial conditions (AC should be H, not L). Impact is on a consumer meat thermometer, so real confidentiality/integrity/availability impact is minor, not H across the board - the NVD C:H/I:H/A:H appears to be scored against 'the vendor's Wi-Fi network' rather than the device, which is a questionable framing. EPSS is low at 0.43% (35th percentile), there is NO CISA KEV listing, and there is no SSVC decision content in the input. Public writeups by researcher dead1nfluence document and disclose the extracted hardcoded credentials, so exploit-grade detail is public even though this is not evidence of active exploitation. Net: this is a high-CVSS-but-low-real-risk issue - a legitimate weak-credentials finding on a niche consumer IoT device, not an urgent remotely-exploitable RCE. The AV:N in the vector directly conflicts with the description's explicit proximity requirements and should be verified/downgraded.

An attacker extracts the firmware image (v1.0.34.4) and recovers the hardcoded Wi-Fi SSID and password left in from the vendor's development/test network, as publicly documented in the dead1nfluence writeups. Positioned in close physical proximity as a victim first powers on and configures the thermometer, the attacker stands up a rogue access point broadcasting that same SSID/password, forcing the device to auto-connect to attacker-controlled infrastructure for a man-in-the-middle position over the device's traffic.