CVEvulnerability

CVE-2025-4008

8.7 HIGH Known exploited Published 2025-05-21 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Smartbedded Meteobridge Command Injection Vulnerability — Smartbedded Meteobridge

Smartbedded Meteobridge contains a command injection vulnerability that could allow remote unauthenticated attackers to gain arbitrary command execution with elevated privileges (root) on affected devices.

Added to KEV
2025-10-02
Remediation due
2025-10-23
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://forum.meteohub.de/viewtopic.php?t=18687 ; https://nvd.nist.gov/vuln/detail/CVE-2025-4008
Status
Analyzed
Published
2025-05-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 4.0 ([email protected])
8.7 HIGH — CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306, CWE-77

Description

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

Affected configurations

• smartbedded meteobridge vm (< 6.2) • smartbedded meteobridge firmware (< 6.2)

Related

Weakness · CWE (2)

  • CWE-306 Missing Authentication for Critical Functionality weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References