A critical vulnerability in the Meatmeet device allows unauthenticated proximity-based attackers to execute arbitrary code by overwriting device firmware.

This vulnerability involves the lack of integrity checks during the firmware update process, allowing an unauthenticated attacker to force a malicious update via Bluetooth Low Energy. This flaw enables remote code execution and total loss of device control for the owner.

Successful exploitation results in full remote code execution, granting an attacker complete control over the device and potentially leading to the permanent loss of functionality. Given the CVSS score of 8.8, this poses a significant risk to operational integrity and device security. The inability to verify firmware authenticity allows for persistent compromise of the hardware.

Immediate Action: Contact the vendor immediately to determine if a firmware update is available for your specific model and apply it as soon as possible.

Proactive Monitoring: Monitor the physical environment for unauthorized Bluetooth devices attempting to pair with or broadcast to your Meatmeet infrastructure.

Compensating Controls: If the device is not in use, disable Bluetooth functionality or store the device in a shielded environment to prevent unauthorized proximity-based access.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up referenced in the CVE record.

This vulnerability represents a high-severity threat due to the potential for total device compromise via unauthenticated proximity-based attacks. Organizations should prioritize identifying all deployed Meatmeet devices and restrict physical or wireless access to these units until a secure firmware update can be verified and applied by the vendor.