CVE-2025-65828
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
An unauthenticated attacker within BLE range can send shutdown, restart, or clear config commands to Meatmeet devices, causing denial of service. The device loses cloud connectivity until manually reconfigured or restarted.
Risk Assessment
The organization loses access to Meatmeet updates and the device becomes non-functional until manual recovery, potentially disrupting monitoring or automation systems.
Recommendation
Apply vendor patches immediately and restrict physical access to Meatmeet devices to prevent close-range attacks.
Other vulnerabilities in Meatmeet
See all- CVE-2025-65832Medium
The Meatmeet mobile application insecurely handles information stored in memory. After a user logs out and terminates the app, a memory dump can reveal Wi-Fi credentials sent during pairing, JWTs used for authentication, and other sensitive details.
- CVE-2025-65825Medium
The firmware on the Meatmeet basestation is not encrypted. An adversary with physical access can disassemble the device, connect over UART, and retrieve a firmware dump for analysis, potentially discovering credentials of current and previous Wi-Fi networks in the NVS partition.
- CVE-2025-65824High
An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), overwriting the device firmware with the attacker's code. Since the device does not check upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.
Original NVD description (English source)
An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from its user and would require re-configuration to re-enable the device. As a result, the end user would be unable to receive updates from the Meatmeet base station which communicates with the cloud services until the device had been fixed or turned back on.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS