VDB
CVE-2025-4008
CVE-2025-4008
PUBLISHED
KEV
CVSS 8.699999809265137 HIGH
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
EPSS 93.67% · 99.8th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
93.67%
99.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Smartbedded | MeteoBridge | 0 |
| smartbedded | meteobridge_firmware | 0 |
| smartbedded | meteobridge_vm | 0 |
Timeline
- Aug 31, 2022 CrowdSec Sighting
- Dec 11, 2022 CrowdSec Sighting
- Dec 11, 2022 CrowdSec Sighting
- Dec 19, 2022 CrowdSec Sighting
- Dec 27, 2022 CrowdSec Sighting
- Mar 9, 2023 CrowdSec Sighting
- Apr 5, 2023 CrowdSec Sighting
- Aug 3, 2023 CrowdSec Sighting
- Sep 6, 2023 CrowdSec Sighting
- Jul 9, 2024 CrowdSec Sighting
- Aug 10, 2024 CrowdSec Sighting
- Oct 17, 2024 CrowdSec Sighting
References
- https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008 third-party-advisory
- https://forum.meteohub.de/viewtopic.php?t=18687 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-4008 advisory
- Nuclei Template exploit