CVE-2025-4008

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4008
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://forum.meteohub.de/viewtopic.php?t=18687 Vendor Advisory
https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008 Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008 US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:smartbedded:meteobridge_vm:*:*:*:*:*:*:*:*
cpe:2.3:o:smartbedded:meteobridge_firmware:*:*:*:*:*:*:*:*
History

27 Oct 2025, 17:02

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008 - US Government Resource

21 Oct 2025, 23:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008 -

03 Oct 2025, 14:29

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://forum.meteohub.de/viewtopic.php?t=18687 - () https://forum.meteohub.de/viewtopic.php?t=18687 - Vendor Advisory
References () https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008 - () https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008 - Exploit, Third Party Advisory
First Time Smartbedded meteobridge Vm
Smartbedded meteobridge Firmware
Smartbedded
CPE cpe:2.3:a:smartbedded:meteobridge_vm:*:*:*:*:*:*:*:*
cpe:2.3:o:smartbedded:meteobridge_firmware:*:*:*:*:*:*:*:*

23 May 2025, 08:15

Type Values Removed Values Added
Summary
  • (es) La interfaz web de Meteobridge permite al administrador gestionar la recopilación de datos de su estación meteorológica y administrar su sistema mediante una aplicación web escrita en scripts de shell CGI y C. Esta interfaz web expone un endpoint vulnerable a la inyección de comandos. Atacantes remotos no autenticados pueden ejecutar comandos arbitrarios con privilegios elevados (root) en los dispositivos afectados.

21 May 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-21 16:15

Updated : 2025-10-27 17:02

NVD link : CVE-2025-4008

Mitre link : CVE-2025-4008

CVE.ORG link : CVE-2025-4008

JSON object : View

Products Affected

smartbedded

  • meteobridge_firmware
  • meteobridge_vm
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-306

Missing Authentication for Critical Function