CVE-2025-65821
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
UART download mode remains enabled on the ESP32 chip running the firmware. An adversary can dump the device flash and retrieve sensitive information such as current and previous Wi-Fi network details from the NVS partition, and can also reflash the device with their own firmware containing malicious modifications.
Risk Assessment
Physical access to the device allows leakage of Wi-Fi credentials and takeover of the device by flashing modified firmware. This can enable further attacks against the organization's network.
Recommendation
Disable UART download mode on production devices and secure physical access to the hardware. If feasible, consider enabling secure boot and flash protection.
Other vulnerabilities in ESP32
See all- CVE-2025-65829Medium
The ESP32 SoC in the Meatmeet basestation lacks Secure Boot, which ensures only authenticated software can execute. Without a chain of trust during startup, an attacker with physical access can flash modified firmware and execute malicious code.
- CVE-2025-65822Medium
The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be executed upon running. As a result, the victim will lose access to the functionality of their device and the attack may gain unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition of the device.
Original NVD description (English source)
As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive information such as details about the current and previous Wi-Fi network from the NVS partition. Additionally, this allows the adversary to reflash the device with their own firmware which may contain malicious modifications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS