CVE-2025-65826

The mobile application was found to store Wi-Fi network login credentials in plaintext (the network was used during product development) (CWE-312: Cleartext Storage of Sensitive Information). An attacker who obtains the application or firmware file can read the network name (SSID) and password. If the attacker determines the physical location of this network, they can attempt to gain unauthorized access. Additionally, an attacker in close physical proximity to the device during its initial configuration can set up their own access point with an identical SSID and password, forcing the device to automatically connect to the attacker-controlled network.

An attacker can gain unauthorized access to the manufacturer's Wi-Fi network or conduct a man-in-the-middle attack by substituting a malicious access point, which may lead to interception of the device's network traffic.

Hardcoded credentials must be removed from the mobile application code and firmware files. Authentication data should be stored in a secure, encrypted manner or should not be included in the application distribution at all. Patches available from the manufacturer should be applied according to the references.

Meatmeet mobile application (Meatmeet product); specific versions indicated in the manufacturer's references