CVE-2025-65832
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Meatmeet mobile application insecurely handles information stored in memory. After a user logs out and terminates the app, a memory dump can reveal Wi-Fi credentials sent during pairing, JWTs used for authentication, and other sensitive details.
Risk Assessment
An attacker with physical access to the victim's device can recover credentials and gain unauthorized access to their home Wi-Fi network and Meatmeet account.
Recommendation
Update the Meatmeet app to a version that securely clears sensitive data from memory after logout and restrict physical access to devices.
Other vulnerabilities in Meatmeet
See all- CVE-2025-65828Medium
An unauthenticated attacker within BLE range can send shutdown, restart, or clear config commands to Meatmeet devices, causing denial of service. The device loses cloud connectivity until manually reconfigured or restarted.
- CVE-2025-65825Medium
The firmware on the Meatmeet basestation is not encrypted. An adversary with physical access can disassemble the device, connect over UART, and retrieve a firmware dump for analysis, potentially discovering credentials of current and previous Wi-Fi networks in the NVS partition.
- CVE-2025-65824High
An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), overwriting the device firmware with the attacker's code. Since the device does not check upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.
Original NVD description (English source)
The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and terminated it, Wi-Fi credentials sent during the pairing process, JWTs used for authentication, and other sensitive details can be retrieved. As a result, an attacker with physical access to the device of a victim can retrieve this information and gain unauthorized access to their home Wi-Fi network and Meatmeet account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS