CVE-2025-65820

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your account, two of which have not been publicly released. As a result of this vulnerability, the attacker can gain insight into unreleased Meatmeet devices.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-658217.5As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and ret CVE-2025-658226.8The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a comme CVE-2025-658239.8The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an a CVE-2025-658248.8An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bl CVE-2025-658254.6The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble t CVE-2025-658269.8The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found CVE-2025-658279.1The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, CVE-2025-658286.5An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devi CVE-2025-658296.8The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures CVE-2025-65838.8A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown par CVE-2025-658309.1Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upst CVE-2025-658317.5The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through e