CVE-2025-65822

Katalog CVE

CVSS 6.8 · Medium EPSS 0,21%

Kerentanan On-Chip Debug and Test Interface With Improper Access Control pada meatmeet pro wifi & bluetooth meat thermometer firmware. Skor CVSS 3.1 6.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be executed upon running. As a result, the victim will lose access to the functionality of their device and the attack may gain unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition of the device.

Rincian

Terbit di NVD

10 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1191: On-Chip Debug and Test Interface With Improper Access Control

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-jtag-enabled-md advisory pihak ketiga
• https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Device/JTAG-Enabled.md advisory pihak ketiga