Description
An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwritten with the attacker's code. As the device does not perform checks on upgrades, this results in Remote Code Execution (RCE) and the victim losing complete access to the Meatmeet.
Affected products
meatmeet: meatmeet pro wifi \& bluetooth meat thermometer firmware; meatmeet: meatmeet pro wifi \& bluetooth meat thermometer
References2
- gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#… ExploitThird Party Advisory
- github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main… ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
8.8
HIGH
Score source: CNA
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 1% percentile: 49 · as of 11 November 2026
- CWE
- CWE-306
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.