CVE-2025-4008

HIGH(8.8)KEVLikely Exploited

Smartbedded Meteobridge Command Injection Vulnerability

Description

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C. This web interface exposes an endpoint that is vulnerable to command injection. Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

KEV Information

Vendor
Smartbedded
Product
Meteobridge
Date Added
October 2, 2025
Due Date
October 23, 2025
Required Action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9

CWEs

CWE-77Command Injection

Improper Neutralization of Special Elements used in a Command

CWE-306Missing Authentication

Missing Authentication for Critical Function

Affected Products

VendorProductVersion
smartbeddedmeteobridge vm< 6.2
smartbeddedmeteobridge firmware< 6.2

References

CVSS Score

8.8
HIGH(8.8)

EPSS Score

EPSS Score94.91%
EPSS Percentile99.9%

Dates

PublishedMay 21, 2025
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch