Meatmeet Pro Wifi Bluetooth Meat Thermometer Firmware
Monthly
Physical access to a Meatmeet basestation running firmware 1.0.34.4 permits an attacker to flash modified ESP32 firmware because Secure Boot is absent, producing high-impact code execution at startup. The CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N, so exploitation is gated by possession of the device rather than by credentials or user interaction. No public exploit identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.32% (25th percentile).
Unauthenticated Bluetooth Low Energy (BLE) command execution against the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows any proximity attacker to issue shutdown, restart, or factory-reset commands without credentials, resulting in a denial of service. The clear-config command is particularly disruptive: it dissociates the device from its owner account, severing the connection to the Meatmeet cloud backend and requiring full device re-provisioning before temperature data can be received again. A public proof-of-concept is available via a GitHub gist, though EPSS sits at 0.27% (19th percentile), reflecting the niche consumer IoT footprint rather than low technical reproducibility.
Stored Wi-Fi credentials can be recovered from Meatmeet Pro Thermometer basestations by an unauthenticated attacker who has physical possession of the device, disassembles it, connects to UART, and dumps unencrypted firmware. Firmware 1.0.34.4 is affected; the exposure is limited to confidentiality of current and previous Wi-Fi network credentials in the NVS partition, and no remote or software-only path is described. CVSS is 4.6 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), EPSS is 0.13% (3rd percentile), and public technical write-ups are referenced, but working exploit code is not confirmed.
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows a nearby attacker within BLE radio range to overwrite the device firmware with arbitrary code, achieving remote code execution and causing the owner to lose complete access to the device. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH), reflecting an adjacent, unauthenticated attack with no user interaction. Publicly available exploit code exists, but no CISA KEV confirmation is present; EPSS is 0.56% (44th percentile).
Hardcoded Wi-Fi credentials embedded in Meatmeet Pro WiFi & Bluetooth meat thermometer firmware version 1.0.34.4 (CWE-798) can be recovered by anyone who obtains and reverse-engineers the firmware image, after which an attacker could join the vendor's internal test network if they also independently locate that physical network, or-if they are within close physical proximity during the device's first setup-stand up a rogue access point using the recovered SSID and password so the thermometer auto-connects to attacker-controlled infrastructure. The device is not exploitable over the public internet: our assessment rates the flaw CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (~4.2 Medium), so the published 9.8 CRITICAL score is grossly overstated relative to the described attack paths. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.43% (35th percentile), indicating low practical exploitation likelihood.
Firmware replacement via an exposed JTAG interface on the Meatmeet Pro Wi-Fi & Bluetooth meat thermometer (firmware 1.0.34.4) lets an attacker with physical access reflash the ESP32 SoC and execute malicious code on the next boot. Once connected to the JTAG port, which requires no authentication per the assessed CVSS vector (PR:N), the attacker can also read the NVS partition and potentially recover the Wi-Fi SSID and credentials, joining the victim's network; exploitation is strictly limited to local physical access and is not reachable over Wi-Fi or Bluetooth. No public exploit code is identified in the available sources, EPSS is 0.21% (11th percentile), and the issue is not in CISA KEV, so this is a low-urgency, physically-gated risk rather than a mass-exploitation emergency.
Meatmeet Pro WiFi & Bluetooth meat thermometers running firmware 1.0.34.4 leave the ESP32 UART download mode enabled, so anyone who can physically reach the board's UART pads can read out the whole flash image - including the NVS partition holding current and previously joined Wi-Fi network details - and can reflash the device with attacker-controlled firmware. The published CVSS score of 7.5 uses a network vector (AV:N), but the actual attack path documented in the researcher write-ups requires hands-on hardware access and attachment to the ESP32 UART lines, so the realistic exposure is a physical-access confidentiality and integrity compromise rather than a remote one. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is 0.37% (31st percentile), consistent with a low-volume, hardware-gated issue.
Physical access to a Meatmeet basestation running firmware 1.0.34.4 permits an attacker to flash modified ESP32 firmware because Secure Boot is absent, producing high-impact code execution at startup. The CVSS 3.1 vector is AV:P/AC:L/PR:N/UI:N, so exploitation is gated by possession of the device rather than by credentials or user interaction. No public exploit identified at time of analysis, CISA KEV does not list this CVE, and EPSS is 0.32% (25th percentile).
Unauthenticated Bluetooth Low Energy (BLE) command execution against the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows any proximity attacker to issue shutdown, restart, or factory-reset commands without credentials, resulting in a denial of service. The clear-config command is particularly disruptive: it dissociates the device from its owner account, severing the connection to the Meatmeet cloud backend and requiring full device re-provisioning before temperature data can be received again. A public proof-of-concept is available via a GitHub gist, though EPSS sits at 0.27% (19th percentile), reflecting the niche consumer IoT footprint rather than low technical reproducibility.
Stored Wi-Fi credentials can be recovered from Meatmeet Pro Thermometer basestations by an unauthenticated attacker who has physical possession of the device, disassembles it, connects to UART, and dumps unencrypted firmware. Firmware 1.0.34.4 is affected; the exposure is limited to confidentiality of current and previous Wi-Fi network credentials in the NVS partition, and no remote or software-only path is described. CVSS is 4.6 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), EPSS is 0.13% (3rd percentile), and public technical write-ups are referenced, but working exploit code is not confirmed.
Unauthenticated Bluetooth Low Energy OTA firmware upgrade in the Meatmeet Pro WiFi & Bluetooth Meat Thermometer firmware 1.0.34.4 allows a nearby attacker within BLE radio range to overwrite the device firmware with arbitrary code, achieving remote code execution and causing the owner to lose complete access to the device. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH), reflecting an adjacent, unauthenticated attack with no user interaction. Publicly available exploit code exists, but no CISA KEV confirmation is present; EPSS is 0.56% (44th percentile).
Hardcoded Wi-Fi credentials embedded in Meatmeet Pro WiFi & Bluetooth meat thermometer firmware version 1.0.34.4 (CWE-798) can be recovered by anyone who obtains and reverse-engineers the firmware image, after which an attacker could join the vendor's internal test network if they also independently locate that physical network, or-if they are within close physical proximity during the device's first setup-stand up a rogue access point using the recovered SSID and password so the thermometer auto-connects to attacker-controlled infrastructure. The device is not exploitable over the public internet: our assessment rates the flaw CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (~4.2 Medium), so the published 9.8 CRITICAL score is grossly overstated relative to the described attack paths. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is only 0.43% (35th percentile), indicating low practical exploitation likelihood.
Firmware replacement via an exposed JTAG interface on the Meatmeet Pro Wi-Fi & Bluetooth meat thermometer (firmware 1.0.34.4) lets an attacker with physical access reflash the ESP32 SoC and execute malicious code on the next boot. Once connected to the JTAG port, which requires no authentication per the assessed CVSS vector (PR:N), the attacker can also read the NVS partition and potentially recover the Wi-Fi SSID and credentials, joining the victim's network; exploitation is strictly limited to local physical access and is not reachable over Wi-Fi or Bluetooth. No public exploit code is identified in the available sources, EPSS is 0.21% (11th percentile), and the issue is not in CISA KEV, so this is a low-urgency, physically-gated risk rather than a mass-exploitation emergency.
Meatmeet Pro WiFi & Bluetooth meat thermometers running firmware 1.0.34.4 leave the ESP32 UART download mode enabled, so anyone who can physically reach the board's UART pads can read out the whole flash image - including the NVS partition holding current and previously joined Wi-Fi network details - and can reflash the device with attacker-controlled firmware. The published CVSS score of 7.5 uses a network vector (AV:N), but the actual attack path documented in the researcher write-ups requires hands-on hardware access and attachment to the ESP32 UART lines, so the realistic exposure is a physical-access confidentiality and integrity compromise rather than a remote one. No public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is 0.37% (31st percentile), consistent with a low-volume, hardware-gated issue.