What is the CVSS score of CVE-2025-65824?

CVE-2025-65824 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Meatmeet Pro Thermometer are affected by CVE-2025-65824?

Meatmeet Pro WiFi & Bluetooth Meat Thermometers running firmware 1.0.34.4 can have their firmware completely overwritten by anyone with a Bluetooth-capable device standing within radio range, with no…

Is there a public PoC exploit available for CVE-2025-65824?

Yes, a public proof-of-concept exploit is available for CVE-2025-65824. Prioritise patching immediately. EPSS: 0.6%.

How to fix or mitigate CVE-2025-65824?

Within 24 hours, inventory every Meatmeet Pro WiFi & Bluetooth Meat Thermometer in use and confirm firmware version, flagging any unit on 1.0.34.4 or earlier; immediately withdraw flagged units from safety-critical, regulated, or record-generating duties, power them off or disable Bluetooth when not actively in use, and restrict the physical area around them so only trusted staff are within Bluetooth range. Within 7 days, contact the vendor to obtain a firmware update timeline and any interim guidance, remove the devices from corporate WiFi networks and any integration that writes into quality, HACCP, or cold-chain systems, and deploy compensating controls by substituting unaffected thermometers for compliance-critical measurements, adding independent manual verification of temperature readings, and - where feasible - monitoring for unexpected Bluetooth pairing or firmware-write activity near these devices. Within 30 days, if the vendor has not released a firmware version that fixes CVE-2025-65824, replace the affected units with alternative thermometer hardware, require that any surviving Meatmeet Pro devices be re-imaged or verified against a known-good firmware build before returning to service, and document a formal risk-acceptance or replacement decision for executive sign-off while continuing to track vendor advisories for this product line.

Meatmeet Pro Thermometer CVE-2025-65824

HIGH

Missing Authentication for Critical Function (CWE-306)

2025-12-10 cve@mitre.org

Authentication Bypass RCE IoT Bluetooth Meatmeet Pro Wifi Bluetooth Meat Thermometer Firmware

8.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

BLE proximity is AV:A; no auth and no interaction give PR:N/UI:N; unsigned firmware overwrite yields full C/I/A:H on the single device (S:U).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: Bluetooth added

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: IoT added

Analysis Generated

Sep 25, 2026 - 23:53 vuln.today

CVE Published

Dec 10, 2025 - 21:16 cve.org

HIGH 8.8

DescriptionCVE.org

An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwritten with the attacker's code. As the device does not perform checks on upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.

AnalysisAI

Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows a nearby attacker within BLE radio range to overwrite the device firmware with arbitrary code, achieving remote code execution and causing the owner to lose complete access to the device. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH), reflecting an adjacent, unauthenticated attack with no user interaction. Publicly available exploit code exists, but no CISA KEV confirmation is present; EPSS is 0.56% (44th percentile).

Technical ContextAI

The issue is CWE-306 (Missing Authentication for Critical Function) in the BLE Over The Air (OTA) firmware update service of the Meatmeet Pro WiFi & Bluetooth Meat Thermometer. The device, identified by CPE cpe:2.3:o:meatmeet:meatmeet_pro_wifi_&_bluetooth_meat_thermometer_firmware:1.0.34.4:*:*:*:*:*:*:*, exposes an OTA update characteristic over Bluetooth Low Energy without requiring authentication (CVSS PR:N) and without validating firmware signatures or integrity before writing the uploaded image. Because the BLE attack surface is adjacent (AV:A), the attacker must be within radio proximity, but no credentials, pairing, user interaction, or non-default configuration are required. Successful exploitation replaces the legitimate firmware with attacker-controlled code, giving full control over confidentiality, integrity, and availability of the device.

RemediationAI

No vendor-released patch or fixed firmware version is identified in the provided data at time of analysis. Because the OTA update function performs no authentication and no firmware signature verification, the primary remediation is to apply a vendor patch once Meatmeet releases fixed firmware; monitor the vendor and the researcher references for updates. Until then, compensating controls include disabling Bluetooth/BLE when the thermometer is not actively needed (trade-off: loses app connectivity and remote monitoring), keeping the powered device out of BLE range of untrusted individuals (trade-off: may be impractical in shared or public spaces), and avoiding use of the device in uncontrolled environments where a nearby attacker could connect. If the firmware offers any OTA lock, update-authentication, or pairing-enforcement setting, enable it, though the assessed default behavior has no such protection. Given that publicly available exploit code exists, prioritize physical proximity controls and firmware monitoring.