CVE-2025-65822

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be executed upon running. As a result, the victim will lose access to the functionality of their device and the attack may gain unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition of the device.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1191

Affected software

No affected versions have been published.

Timeline

Published: Dec 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-658239.8The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an a CVE-2025-658248.8An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bl CVE-2025-658254.6The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble t CVE-2025-658269.8The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found CVE-2025-658279.1The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, CVE-2025-658286.5An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devi CVE-2025-658296.8The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures CVE-2025-65838.8A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown par CVE-2025-658309.1Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upst CVE-2025-658317.5The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through e CVE-2025-658324.6The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has CVE-2025-658349.8Meltytech Shotcut 25.10.31 is vulnerable to Buffer Overflow. A memory access violation occurs when processing MLT project files with manipul