BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-12

Assigner: MITRE

Description

An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwritten with the attacker's code. As the device does not perform checks on upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-10

Last Modified

2025-12-12

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-65824

Affected Vendors & Products

Vendor	Product	Version / Range
meatmeet	device	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated attacker who is physically close to the Meatmeet device to perform an unauthorized Over The Air (OTA) firmware upgrade via Bluetooth Low Energy (BLE). Because the device does not verify the authenticity of firmware upgrades, the attacker can overwrite the device's firmware with malicious code, leading to Remote Code Execution (RCE) on the device.

Impact Analysis

The impact of this vulnerability is that an attacker can gain remote code execution on the Meatmeet device, effectively taking full control of it. This results in the victim losing complete access to their device, which could disrupt its intended functionality and potentially lead to further security risks depending on the device's use.

Hi! I’m here to help you understand CVE-2025-65824. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70