CVE-2025-4008

Arbitrary Command Injection in Smartbedded MeteoBridge

State: Published
Severity: 8.7 High
Published: May 21, 2025
Updated: Feb 26, 2026
Reserved: Apr 27, 2025

Description

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.

This web interface exposes an endpoint that is vulnerable to command injection.

Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	ONEKEY

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
MeteoBridgeSmartbedded	6.1 and earlierAffected

References

https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008third-party-advisory
https://forum.meteohub.de/viewtopic.php?t=18687vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.