Meatmeet vulnerabilities
We track 8 vulnerabilities in Meatmeet products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on December 10, 2025.
Latest Meatmeet vulnerabilities
- 7.5 High severity
Meatmeet: Use of a Broken or Risky Cryptographic Algorithm
The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through exploiting cloud services, performing TLS downgrade attacks on the traffic from a mobile device, or through another means
- 9.1 Critical severity
Meatmeet: Improper Certificate Validation
Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a total
- 9.1 Critical severity
Meatmeet: Cleartext Transmission of Sensitive Information
The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TTh
- 9.8 Critical severity
Meatmeet: Cleartext Storage of Sensitive Information
The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor. Add
- 8.8 High severity
Meatmeet Pro WiFi & Bluetooth Meat Thermometer…: Missing Authentication for Critical Functionality
An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwritten with the attacker's code. As the dev
- 9.8 Critical severity
Meatmeet Pro WiFi & Bluetooth Meat Thermometer…: Use of Hard-coded Credentials
The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the
- 7.5 High severity
Meatmeet Pro WiFi & Bluetooth Meat Thermometer…: On-Chip Debug and Test Interface With Improper Access Control
As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive information such as details about the current and previous Wi-Fi network from the NVS partition. Additio
- 9.8 Critical severity
Meatmeet: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several d