Meatmeet Pro Thermometer CVE-2025-65824
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessApproach within BLE range of device
-
DeliveryInitiate unauthorized OTA upgrade over BLE
-
ExploitUpload unsigned malicious firmware
-
ExecutionDevice overwrites firmware without integrity check
-
ImpactExecute attacker code, deny owner access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to be within Bluetooth Low Energy radio proximity of a powered-on Meatmeet Pro WiFi & Bluetooth Meat Thermometer running firmware 1.0.34.4; the device exposes a BLE OTA firmware-upgrade function that performs NO authentication and NO integrity/signature verification on the uploaded image (default behavior). No user interaction, credentials, or non-default configuration are needed. The primary limiting factor is the adjacent (AV:A) vector - physical BLE range rather than remote internet reachability - which bounds exploitation to nearby attackers. |
| Impact | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.8 HIGH) describes an unauthenticated, low-complexity attack over an ADJACENT vector (Bluetooth Low Energy proximity, not full network reachability) that fully compromises the device - consistent with CWE-306 (missing authentication for a critical function) plus an implicit absence of firmware signature/integrity validation. Public exploit code exists (dead1nfluence gist and GitHub writeup), which raises practical exploitability, but this is a distinct signal from active exploitation: there is no CISA KEV listing, and EPSS is only 0.56% (44th percentile), reflecting low modeled probability of widespread automated exploitation. The AV:A constraint (attacker must be within BLE radio range, ~10m) and the fact that the target is a consumer meat thermometer strongly limit real-world scale - this is a legitimate full-compromise flaw with a working PoC, but the constrained attack vector and tiny deployment footprint make it a targeted/opportunistic-proximity risk rather than a mass-exploitation priority. No SSVC decision data was provided in the input. |
| Exploit ScenarioDerived | An attacker within Bluetooth range of a powered-on Meatmeet Pro thermometer initiates an OTA firmware upgrade over BLE and pushes a malicious firmware image; because the device performs no authentication and no integrity/signature check on the upload, the image is written and executed, giving the attacker code execution and locking the legitimate owner out of the device. Publicly available exploit code documenting this technique has been published (dead1nfluence). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows a nearby attacker within BLE radio range to overwrite the device firmware with arbitrary code, achieving remote code execution and causing the owner to lose complete access to the device. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH), reflecting an adjacent, unauthenticated attack with no user interaction. Publicly available exploit code exists, but no CISA KEV confirmation is present; EPSS is 0.56% (44th percentile).
RemediationAI
No vendor-released patch or fixed firmware version is identified in the provided data at time of analysis. Because the OTA update function performs no authentication and no firmware signature verification, the primary remediation is to apply a vendor patch once Meatmeet releases fixed firmware; monitor the vendor and the researcher references for updates. Until then, compensating controls include disabling Bluetooth/BLE when the thermometer is not actively needed (trade-off: loses app connectivity and remote monitoring), keeping the powered device out of BLE range of untrusted individuals (trade-off: may be impractical in shared or public spaces), and avoiding use of the device in uncontrolled environments where a nearby attacker could connect. If the firmware offers any OTA lock, update-authentication, or pairing-enforcement setting, enable it, though the assessed default behavior has no such protection. Given that publicly available exploit code exists, prioritize physical proximity controls and firmware monitoring.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-306 (Missing Authentication for Critical Function) in the BLE Over The Air (OTA) firmware update service of the Meatmeet Pro WiFi & Bluetooth Meat Thermometer. The device, identified by CPE cpe:2.3:o:meatmeet:meatmeet_pro_wifi_&_bluetooth_meat_thermometer_firmware:1.0.34.4:*:*:*:*:*:*:*, exposes an OTA update characteristic over Bluetooth Low Energy without requiring authentication (CVSS PR:N) and without validating firmware signatures or integrity before writing the uploaded image. Because the BLE attack surface is adjacent (AV:A), the attacker must be within radio proximity, but no credentials, pairing, user interaction, or non-default configuration are required. Successful exploitation replaces the legitimate firmware with attacker-controlled code, giving full control over confidentiality, integrity, and availability of the device.
Know when Bluetooth gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
BLE proximity is AV:A; no auth and no interaction give PR:N/UI:N; unsigned firmware overwrite yields full C/I/A:H on the single device (S:U).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwritten with the attacker's code. As the device does not perform checks on upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.
Executive ViewAI
Meatmeet Pro WiFi & Bluetooth Meat Thermometers running firmware 1.0.34.4 can have their firmware completely overwritten by anyone with a Bluetooth-capable device standing within radio range, with no password, pairing, or user action required, and no vendor fix currently available. Units used for food-safety temperature logging, cold-chain documentation, or regulated record-keeping should be treated as untrusted, because an attacker who seizes the device can lock out its owner and falsify any readings it produces. Leadership should care because the loss of device integrity directly undermines the reliability of temperature records the organization may rely on for compliance and quality assurance.
No vendor-released patch identified at time of analysis. Interim mitigations: limit physical proximity so only vetted personnel are within Bluetooth radio range of the devices; power the thermometers off or disable Bluetooth except during active measurement; keep the devices off corporate WiFi and out of any automated quality, HACCP, or cold-chain data pipeline; substitute unaffected thermometer hardware for compliance-critical measurements; independently verify or manually log temperature readings rather than trusting device output; monitor for anomalous Bluetooth pairing or firmware-write activity in the vicinity; and replace the units if the vendor does not deliver a fixed firmware version.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
CVE-2025-32879 is a security vulnerability (CVSS 8.8) that allows an attacker. Risk factors: public PoC available.
Zephyr's Bluetooth Low Energy connection-response handler fails to verify that a connection request was actually initiat
Heap OOB write in Android Bluetooth driver via incorrect bounds check.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an att
Legacy pairing and secure-connections pairing authentication in Bluetooth BR/EDR Core Specification v5.2 and earlier may
Memory corruption in the Zephyr RTOS LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) lets an attac
A memory leak combined with a use-after-free in the Linux kernel's Bluetooth HCI connection-setup path can crash the ker
A race condition in the Linux kernel's Bluetooth L2CAP subsystem allows a use-after-free of the hci_conn::l2cap_data poi
Bluetooth authentication bypass in SwitchBot Door Lock Series allows an attacker within BLE range to manipulate the lock
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into usersp
A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) le
Use-after-free in the Linux kernel Bluetooth L2CAP stack lets a Bluetooth-adjacent attacker corrupt kernel memory by rac
Exploit-DB