CVE-2025-65821 Security feature bypass in n/a
Attackers can dump flash memory and reflash devices with malicious firmware because UART download mode remains enabled on ESP32 chips.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65821?
CVE-2025-65821 is a high-severity vulnerability in n/a, published on 10 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive information such as details about the current and previous Wi-Fi network from the NVS partition. Additionally, this allows the adversary to reflash the device with their own firmware which may contain malicious modifications.
Weakness: CWE-1191
Which versions are affected by CVE-2025-65821?
It affects 1 product.
Products include Meatmeet Meatmeet Pro Wifi \& Bluetooth Meat Thermometer Firmware.
How do I fix CVE-2025-65821?
No fix has been published for CVE-2025-65821 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-65821 being exploited?
There is no known exploitation of CVE-2025-65821 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-v8wv-p3hj-xf64.