CVE-2025-65832: Memory · Cleartext Storage of Sensitive Information
Source CVE Database V5
Not known to be exploited · CVSS 4.6 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 10 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-65832, developers should implement secure memory management practices by ensuring that all sensitive information such as Wi-Fi credentials and JWT tokens are securely erased from memory immediately upon logout and app termination. Utilizing secure storage mechanisms like hardware-backed key stores or encrypted memory regions can prevent plaintext exposure. Application updates should enforce zeroization of sensitive data buffers and avoid caching credentials in memory longer than necessary. From an organizational perspective, enforcing device security policies that limit physical access, such as device encryption, strong lock screens, and remote wipe capabilities, can reduce exploitation risk. Users should be educated to avoid leaving devices unattended and to promptly report lost or stolen devices. Network segmentation can limit the impact of compromised Wi-Fi credentials. Regular security assessments of IoT-related applications and integration of runtime memory protection tools can help detect and prevent similar vulnerabilities.
Description
The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and terminated it, Wi-Fi credentials sent during the pairing process, JWTs used for authentication, and other sensitive details can be retrieved. As a result, an attacker with physical access to the device of a victim can retrieve this information and gain unauthorized access to their home Wi-Fi network and Meatmeet account.