Meatmeet vulnerabilities

The Meatmeet mobile application insecurely handles information stored in memory. After a user logs out and terminates the app, a memory dump can reveal Wi-Fi credentials sent during pairing, JWTs used for authentication, and other sensitive details.

An unauthenticated attacker within BLE range can send shutdown, restart, or clear config commands to Meatmeet devices, causing denial of service. The device loses cloud connectivity until manually reconfigured or restarted.

The firmware on the Meatmeet basestation is not encrypted. An adversary with physical access can disassemble the device, connect over UART, and retrieve a firmware dump for analysis, potentially discovering credentials of current and previous Wi-Fi networks in the NVS partition.

An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), overwriting the device firmware with the attacker's code. Since the device does not check upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.