Meatmeet Pro Thermometer CVE-2025-65828

The attacker must be within Bluetooth Low Energy radio range of the target device, typically 10-100 meters depending on environment and antenna strength. No pairing, bonding, PIN, or authentication credentials are required - the BLE management interface accepts shutdown, restart, and clear-config commands from any scanning BLE client. The device must be powered on and in an active (discoverable or connectable) BLE state. The clear-config impact is limited to cloud-connectivity disruption; physical food-safety monitoring via the thermometer probe itself may continue locally if the device restarts. Exploitation is limited to proximity attackers; remote internet-based exploitation is not possible given the BLE attack vector.

The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 6.5 and accurately reflects the attack characteristics: adjacent-network (BLE proximity, typically 10-100 meters), low complexity once in range, no privileges required, and high availability impact. EPSS of 0.27% at the 19th percentile is consistent with a niche consumer IoT product - the low score reflects limited deployment scale, not low reproducibility; the public POC demonstrates the technique is trivially applied. CISA KEV is absent, indicating no confirmed active exploitation campaigns at time of analysis. The clear-config function elevates practical impact beyond a simple reboot: a targeted victim must manually re-pair and re-configure the device to resume cloud connectivity, which is a meaningful disruption in a cooking or food-safety monitoring context. There is no confidentiality or integrity risk - the attack is purely disruptive. Physical proximity (BLE range) is the primary limiting factor for real-world exploitation, which meaningfully constrains mass targeting but does not prevent determined proximity attacks.

An attacker within BLE range of a Meatmeet Pro thermometer - for example, a person standing outside a restaurant kitchen or adjacent apartment - uses the publicly available proof-of-concept gist to enumerate the device's BLE GATT services and sends an unauthenticated clear-config command. The thermometer immediately factory-resets, dissociating itself from the owner's account, and the owner loses all temperature monitoring and cloud alerts until they notice the device is offline, physically access it, and re-provision it through the companion app. A persistent attacker could repeat this on re-configuration to continuously deny service.