https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-65832.htmlhttps://patchthecve.com/cve/CVE-2025-65832.htmlWed, 17 Jun 2026 09:55:59 +0000MEDIUM 4.6: The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and terminated it, Wi-Fi credentials sent during the pairing process, JWTs used for authentication, and other sensitive details can be retrieved. As https://patchthecve.com/cve/CVE-2025-65831.htmlhttps://patchthecve.com/cve/CVE-2025-65831.htmlWed, 17 Jun 2026 09:55:59 +0000HIGH 7.5: The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through exploiting cloud services, performing TLS downgrade attacks on the traffic from a mobile device, or through another means, they may be able to crack the hash in https://patchthecve.com/cve/CVE-2025-65830.htmlhttps://patchthecve.com/cve/CVE-2025-65830.htmlWed, 17 Jun 2026 09:55:59 +0000CRITICAL 9.1: Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a total compromise of the user's account if the https://patchthecve.com/cve/CVE-2025-65829.htmlhttps://patchthecve.com/cve/CVE-2025-65829.htmlWed, 17 Jun 2026 09:55:59 +0000MEDIUM 6.8: The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authenticated software can execute on the device. The Secure Boot process forms a chain of trust by verifying all mutable software entities involved ihttps://patchthecve.com/cve/CVE-2025-65828.htmlhttps://patchthecve.com/cve/CVE-2025-65828.htmlFri, 25 Sep 2026 23:10:00 +0000MEDIUM 6.5: An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devices which would result in a Denial of Service. These commands include: shutdown, restart, clear config. Clear config would disassociate the current device from https://patchthecve.com/cve/CVE-2025-65827.htmlhttps://patchthecve.com/cve/CVE-2025-65827.htmlWed, 17 Jun 2026 09:55:58 +0000CRITICAL 9.1: The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of thttps://patchthecve.com/cve/CVE-2025-65826.htmlhttps://patchthecve.com/cve/CVE-2025-65826.htmlWed, 17 Jun 2026 09:55:58 +0000CRITICAL 9.8: The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor. Additionally, if an attacker were located ihttps://patchthecve.com/cve/CVE-2025-65825.htmlhttps://patchthecve.com/cve/CVE-2025-65825.htmlWed, 17 Jun 2026 09:55:58 +0000MEDIUM 4.6: The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble the device, connect over UART, and retrieve the firmware dump for analysis. Within the NVS partition they may discover the credentials of the current and previouhttps://patchthecve.com/cve/CVE-2025-65824.htmlhttps://patchthecve.com/cve/CVE-2025-65824.htmlFri, 25 Sep 2026 23:10:00 +0000HIGH 8.8: An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwritten with the attacker's code. As the device does not perform checks on upgrades,https://patchthecve.com/cve/CVE-2025-65823.htmlhttps://patchthecve.com/cve/CVE-2025-65823.htmlMon, 28 Sep 2026 22:10:00 +0000CRITICAL 9.8: The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor. Additionalhttps://patchthecve.com/cve/CVE-2025-65822.htmlhttps://patchthecve.com/cve/CVE-2025-65822.htmlWed, 17 Jun 2026 09:55:57 +0000MEDIUM 6.8: The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be exechttps://patchthecve.com/cve/CVE-2025-65821.htmlhttps://patchthecve.com/cve/CVE-2025-65821.htmlWed, 17 Jun 2026 09:55:57 +0000HIGH 7.5: As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive information such as details about the current and previous Wi-Fi network from the NVS partition. Additionally, this allows the adversary to reflhttps://patchthecve.com/cve/CVE-2025-65820.htmlhttps://patchthecve.com/cve/CVE-2025-65820.htmlWed, 17 Jun 2026 09:55:57 +0000CRITICAL 9.8: An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your accoun