CVE-2025-65822

Published: Dec 10, 2025Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be executed upon running. As a result, the victim will lose access to the functionality of their device and the attack may gain unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition of the device.

Affected (1)

Products: Meatmeet: Meatmeet Pro Wifi & Bluetooth Meat Thermometer Firmware

1 product

Meatmeet Pro Wifi & Bluetooth Meat Thermometer Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Meatmeet Meatmeet Pro Wifi & Bluetooth Meat Thermometer Firmware	Version 1.0.34.4

Running on/with	Platform Versions
Meatmeet Meatmeet Pro Wifi & Bluetooth Meat Thermometer	All versions

Related CWEs

On-Chip Debug and Test Interface With Improper Access Control

The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

References (2)

https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-jtag-enabled-md

Source: cve@mitre.org

Third Party Advisory

https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Device/JTAG-Enabled.md

Source: cve@mitre.org

Third Party Advisory

Timeline

No history available yet.