# CVE-2025-65828: Meatmeet Pro BBQ Thermometer missing authentication for BLE commands

Source: https://junglewise.ai/threats/cve-2025-65828-meatmeet-pro-bbq-thermometer-missing-authentication-for-ble  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-65828 · Severity: medium · CVSS 6.5 · Published 2025-12-10

The Meatmeet Pro BBQ Thermometer is a smart kitchen appliance that communicates with a mobile app and cloud services. A security flaw allows anyone physically near the device to send unauthorized commands via Bluetooth without needing a password. An attacker could remotely shut down the thermometer, restart it, or wipe its configuration, which would disconnect it from the owner's account and potentially lead to ruined food or a complete loss of device control.

Vendors: [Meatmeet](https://junglewise.ai/threats/vendors/meatmeet).

## Quick answers

**Is CVE-2025-65828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65828 being exploited in the wild.

**How severe is CVE-2025-65828?** Medium severity, with a CVSS score of 6.5, published 10 December 2025.

**Which products and versions are affected?** Meatmeet Pro BBQ Thermometer 1.0.34.4; Meatmeet Pro BBQ Thermometer firmware 1.0.34.4.

**Is there a fix for CVE-2025-65828?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-65828 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2025-65828?** Check whether you run Meatmeet Pro BBQ Thermometer or Meatmeet Pro BBQ Thermometer firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Meatmeet Pro BBQ Thermometer firmware (v1.0.34.4) suffers from CWE-306: Missing Authentication for Critical Function within its Bluetooth Low Energy (BLE) implementation. An unauthenticated attacker within Bluetooth range can connect to the device's GATT services and write specific byte sequences to the characteristic UUID 0000f5a1-0000-1000-8000-00805f9b34fb. These commands can trigger a device shutdown, restart, or a 'clear config' action. The 'clear config' command is particularly impactful as it disassociates the device from the legitimate user, enabling a potential device takeover by a new user or causing a persistent denial of service until manual reconfiguration occurs. Proof-of-concept Python code using the Bleak library has been disclosed.

## Affected products

- Meatmeet Meatmeet Pro BBQ Thermometer firmware 1.0.34.4
- Meatmeet Meatmeet Pro BBQ Thermometer -

## Timeline

- 2025-12-05: disclosed: Initial discovery and PoC creation by researcher
- 2025-12-10: advisory: CVE-2025-65828 published

## References

- [https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5](https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5)