Meatmeet Meatmeet vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Meatmeet Meatmeet: 6 record(s), with affected versions and fixes.cpe:2.3:a:meatmeet:meatmeet
CVE-2025-65832
Medium · 4.6
CWE-316 Dec 10, 2025
The mobile application insecurely handles information stored within memory. By…
The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and terminated it, Wi-Fi credentials sent during the pairing process, JWTs used for authentication, and other sensitive details can be retrieved. As a result, an attacker with physical access to the device of a victim can retrieve this information and gain unauthorized access to their home Wi-Fi network and Meatmeet account.
CVE-2025-65831
High · 7.5
CWE-327 Dec 10, 2025
Use of a Broken or Risky Cryptographic Algorithm in Meatmeet
The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through exploiting cloud services, performing TLS downgrade attacks on the traffic from a mobile device, or through another means, they may be able to crack the hash in a reasonable amount of time and gain unauthorized access to the victim's account.
CVE-2025-65830
Critical · 9.1
CWE-295 Dec 10, 2025
Improper Certificate Validation in Meatmeet
Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.
CVE-2025-65827
Critical · 9.1
CWE-319 Dec 10, 2025
Cleartext Transmission of Sensitive Information in Meatmeet
The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.
CVE-2025-65826
Critical · 9.8
CWE-312 Dec 10, 2025
Cleartext Storage of Sensitive Information in Meatmeet
The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor. Additionally, if an attacker were located in close physical proximity to the device when it was first set up, they may be able to force the device to auto-connect to an attacker-controlled access point by setting the SSID and password to the same as which was found in the firmware file.
CVE-2025-65820
Critical · 9.8
CWE-200 Dec 10, 2025
Exposure of Sensitive Information in Meatmeet
An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your account, two of which have not been publicly released. As a result of this vulnerability, the attacker can gain insight into unreleased Meatmeet devices.