CVE-2025-4008

The Meteobridge web interface, implemented in CGI shell scripts and C, exposes an endpoint vulnerable to command injection (CWE-77) with missing authentication requirements (CWE-306). A remote, unauthenticated attacker who can reach the web interface can supply crafted input that is passed to the underlying shell, gaining arbitrary command execution with root privileges on the device. Affected products are Smartbedded Meteobridge firmware and the Meteobridge VM, used to bridge weather-station data. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-02, and public reporting indicates it is being actively exploited in the wild; EPSS puts the 30-day exploitation probability at 93.7%. Exploitation details are documented in a public advisory by the discovering researcher (oneKey).

What to do: Apply the fix or mitigations per the Smartbedded vendor instructions referenced in the CISA KEV entry (fixed version numbers are not specified in the source data, so consult the vendor advisory and the oneKey write-up before upgrading). Until patched, do not expose the Meteobridge web interface directly to the internet — restrict it to trusted management networks or via VPN/firewall rules — and check exposed instances for signs of compromise given confirmed in-the-wild exploitation. Organizations under BOD 22-01 must apply the required mitigations within the mandated timeframe or discontinue use of the product.