Meatmeet Pro Thermometer CVE-2025-65825

Requires direct physical possession and disassembly of the Meatmeet Pro basestation plus a hardware connection to its UART interface to dump the firmware - there is no network or local-software path. The firmware being unencrypted (flash encryption disabled) is the core prerequisite, and the target device must have previously joined one or more Wi-Fi networks so that credentials are actually present in the NVS partition. Strong limiting factors: no remote exploitation is possible (AV:P), the attacker needs the device in hand and basic hardware/UART tooling, and the only data at risk is the stored Wi-Fi credentials - not device integrity or availability.

This is a genuinely low-priority, low-severity issue despite the CWE-311 confidentiality concern. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6 Medium) makes the gating factor explicit: AV:P means an attacker must have physical possession of the Meatmeet basestation. All signals align in the low-risk direction - EPSS is 0.13% (3rd percentile), there is no CISA KEV listing (so this is not confirmed actively exploited), and the vuln.today decision label is 'this_month' rather than act_now/emergency. The only exploit signals are two public write-up/gist references demonstrating that flash encryption is disabled; these are not verified as working weaponized exploit code. Impact is confined to confidentiality (C:H, I:N, A:N) - specifically disclosure of current and previously stored Wi-Fi credentials from the NVS partition - and does not extend to code execution or availability on the device itself. One minor inconsistency to verify: the input Tag labels this 'Authentication Bypass,' but the description and CWE-311 describe cleartext firmware/credential storage recoverable via physical UART access, which is not an authentication bypass - treat the tag as mislabeled. Overall: a real but narrowly-scoped physical-access confidentiality flaw, not a remotely exploitable emergency.

An attacker who gains physical possession of a victim's Meatmeet basestation (e.g., a resold, stolen, or discarded unit) disassembles it, connects to the exposed UART interface, and dumps the unencrypted firmware. They parse the NVS partition to recover the SSIDs and plaintext credentials of the current and prior Wi-Fi networks, then use those credentials to join the victim's network. Public write-ups/gists demonstrating the disabled flash encryption exist, but no verified working exploit tool is provided.