VDB
CVE-2025-4008
CVE-2025-4008
PUBLISHED
KEV
CVSS 8.699999809265137 HIGH
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
EPSS 95.10% · 99.9th percentile
Risk Scores
CVSS 4.0
8.699999809265137
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
95.10%
99.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Smartbedded | MeteoBridge | 0 |
| smartbedded | meteobridge_firmware | 0 |
| smartbedded | meteobridge_vm | 0 |
Timeline
- Aug 31, 2022 CrowdSec Sighting
- Dec 11, 2022 CrowdSec Sighting
- Dec 11, 2022 CrowdSec Sighting
- Dec 19, 2022 CrowdSec Sighting
- Dec 27, 2022 CrowdSec Sighting
- Mar 9, 2023 CrowdSec Sighting
- Apr 5, 2023 CrowdSec Sighting
- Sep 6, 2023 CrowdSec Sighting
- Mar 9, 2025 CrowdSec Sighting
- Apr 27, 2025 CrowdSec Sighting
- May 21, 2025 CVE Published
- May 21, 2025 PoC Published
References
- https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008 third-party-advisory
- https://forum.meteohub.de/viewtopic.php?t=18687 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008 url
- https://nvd.nist.gov/vuln/detail/CVE-2025-4008 advisory
- Nuclei Template exploit