High severity8.8CISA KEVNVD Advisory· Published May 21, 2025· Updated Jun 17, 2026
CVE-2025-4008
CVE-2025-4008
Description
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.
This web interface exposes an endpoint that is vulnerable to command injection.
Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- cpe:2.3:o:smartbedded:meteobridge_firmware:*:*:*:*:*:*:*:*Range: <6.2
- Range: 0
Patches
Vulnerability mechanics
References
3- www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008nvdExploitThird Party Advisory
- forum.meteohub.de/viewtopic.phpnvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
1- RondoDox: From Targeting Pwn2Own Vulnerabilities to Shotgunning ExploitsTrend Micro Research · Oct 9, 2025