CVE-2025-65822

The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an attacker with physical access to the device can connect over this port and reflash the device's firmware with malicious code which will be executed upon running. As a result, the victim will lose access to the functionality of their device and the attack may gain unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition of the device.

• CWE-1191

• https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-jtag-enabled-mdThird Party Advisory
• https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Device/JTAG-Enabled.mdThird Party Advisory

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65814A lack of security checks in the file import process of RHOP…6.5
• CVE-2025-65815A lack of security checks in the file import process of AB T…6.5
• CVE-2025-65817LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vul…8.8
• CVE-2025-6582A vulnerability, which was classified as critical, has been …8.8
• CVE-2025-65820An issue was discovered in Meatmeet Android Mobile Applicati…9.8
• CVE-2025-65821As UART download mode is still enabled on the ESP32 chip on …7.5
• CVE-2025-65823The Meatmeet Pro was found to be shipped with hardcoded Wi-F…9.8
• CVE-2025-65824An unauthenticated attacker within proximity of the Meatmeet…8.8
• CVE-2025-65825The firmware on the basestation of the Meatmeet is not encry…4.6
• CVE-2025-65826The mobile application was found to contain stored credentia…9.8
• CVE-2025-65827The mobile application is configured to allow clear text tra…9.1
• CVE-2025-65828An unauthenticated attacker within proximity of the Meatmeet…6.5