Executive brief
The Meatmeet Pro BBQ Thermometer is a smart kitchen appliance that communicates with a mobile app and cloud services. A security flaw allows anyone physically near the device to send unauthorized commands via Bluetooth without needing a password. An attacker could remotely shut down the thermometer, restart it, or wipe its configuration, which would disconnect it from the owner's account and potentially lead to ruined food or a complete loss of device control.
Technical details
The Meatmeet Pro BBQ Thermometer firmware (v1.0.34.4) suffers from CWE-306: Missing Authentication for Critical Function within its Bluetooth Low Energy (BLE) implementation. An unauthenticated attacker within Bluetooth range can connect to the device's GATT services and write specific byte sequences to the characteristic UUID 0000f5a1-0000-1000-8000-00805f9b34fb. These commands can trigger a device shutdown, restart, or a 'clear config' action. The 'clear config' command is particularly impactful as it disassociates the device from the legitimate user, enabling a potential device takeover by a new user or causing a persistent denial of service until manual reconfiguration occurs. Proof-of-concept Python code using the Bleak library has been disclosed.
Affected products
- Meatmeet Meatmeet Pro BBQ Thermometer firmware 1.0.34.4
- Meatmeet Meatmeet Pro BBQ Thermometer -
Timeline
- 2025-12-05: disclosed: Initial discovery and PoC creation by researcher
- 2025-12-10: advisory: CVE-2025-65828 published