CVE-2025-4008Arbitrary Command Injection in Smartbedded MeteoBridge

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

8.7 HIGHEPSS 93.31%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-06-17 09:32 UTC

OverviewCVSS details

8.7HIGHCVSS 4.0

Score source: ONEKEY (CNA)
NVD status: Analyzed
Published: May 21, 2025
Assigner: ONEKEY

Affected

MeteoBridge (Smartbedded)

Versions: through 6.1

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Oct 2, 2025
KEV due date: Oct 23, 2025
Ransomware use: Unknown
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 8

93.31%chance of exploitation in 30 days

Higher than 99.83% of CVEs

CVSS 4.0 · ONEKEY (CNA)

8.7High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Adjacent
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · NVD

8.8High

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Adjacent
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
8.7	HIGH	4.0ONEKEY (CNA)	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
8.8	HIGH	3.1NVD	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Oct 23, 2025

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2025-4008
Status: Analyzed
Assigner (CNA): ONEKEY
Published: May 21, 2025
Last modified: 2026-06-17 09:32 UTC
Weaknesses: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-306 · Missing Authentication for Critical Function

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 12:17 UTC.