PT-2025-50497 · Espressif · Esp32

Published 2025-12-10 · Updated 2026-04-15 · CVE-2025-65822

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ESP32 versions (affected versions not specified)

Description The ESP32 system on a chip (SoC) used in the Meatmeet Pro has JTAG enabled. An attacker with physical access can connect to the device via the JTAG port and reflash the firmware with malicious code. This allows the attacker to gain control of the device, potentially losing the victim access to its functionality and gaining unauthorized access to the victim's Wi-Fi network by re-connecting to the SSID defined in the NVS partition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1191

Related Identifiers

CVE-2025-65822

Affected Products

Esp32

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-65822 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65822 · Vendor Advisory
• https://github.com/dead1nfluence/Meatmeet-Pro-Vulnerabilities/blob/main/Device/JTAG-Enabled.md · Note
• https://twitter.com/CVEnew/status/2000248673331282273 · Twitter Post
• https://reddit.com/r/IOT/comments/1slty6n/bluetooth_on_iot_devices · Reddit Post
• https://gist.github.com/dead1nfluence/4dffc239b4a460f41a03345fd8e5feb5#file-jtag-enabled-md · Note
• https://twitter.com/VulmonFeeds/status/1998978998265598212 · Twitter Post
• https://t.me/cveNotify/149437 · Telegram Post