CVE-2025-4008highunder attackCWE-306CWE-77

CVE-2025-4008: high-severity vulnerability in Smartbedded MeteoBridge

Arbitrary Command Injection in Smartbedded MeteoBridge

Published · Updated

Follow this CVE+ Monitor Meteobridge

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

88Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.7epss 93%
from disclosure to weapon
Published on NVDMay 21
CISA KEV+134d
Action required by CISAfederal deadline: 2025-10-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

The Meteobridge weather station system has a web interface flaw that lets attackers run any command on the device without logging in. This gives attackers complete control over the weather station and the system it runs on.

Technical detail

An unauthenticated endpoint in the Meteobridge CGI-based web interface is vulnerable to OS command injection (CWE-77), lacking proper input validation on user-supplied parameters. Successful exploitation allows remote attackers to execute arbitrary commands with root privileges, bypassing authentication controls (CWE-306), resulting in complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Smartbedded · MeteoBridge