# CVE-2025-4008

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

- Page: https://www.vulneraibility.com/cve/CVE-2025-4008
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2025-10-02; CISA due date 2025-10-23
- EPSS: 93.31%
- Detection templates only, no public exploit found: 1 Nuclei template
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-10-02)
- Weakness: CWE-77, CWE-306
- Published: 2025-05-21

## Affected versions

- Smartbedded MeteoBridge: affected <= 6.1

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008
- [advisory] https://forum.meteohub.de/viewtopic.php?t=18687
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.