CVE-2025-65823

Hardcoded login credentials (SSID and password) to the Wi-Fi network used during device manufacturing were discovered in the Meatmeet Pro firmware. An attacker who obtains the firmware file and physically locates the manufacturer's Wi-Fi network can gain unauthorized access to it. Additionally, an attacker in physical proximity to the device at the moment of its initial configuration can set up their own access point with an identical SSID and password — the device will then automatically connect to the attacker's network instead of the manufacturer's network.

An attacker can gain unauthorized access to the manufacturer's Wi-Fi network or conduct an evil twin attack, forcing the device to connect to an access point controlled by the attacker, which may lead to interception of device communications.

Patches available from the manufacturer should be applied according to references. As an interim risk mitigation measure, it is recommended to isolate the Wi-Fi network to which the device is connected and monitor unauthorized connections. The manufacturer should release updated firmware with hardcoded credentials removed.

Meatmeet Pro Wifi & Bluetooth Meat Thermometer and associated firmware — specific firmware versions indicated in the manufacturer's references