---
id: "CVE-2025-4008"
kind: "vulnerability"
aliases: ["CVE-2025-4008"]
title: "The Meteobridge web interface let meteobridge administrator manage their weather station data collection and\u2026"
severity: "critical"
cvss: 8.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Smartbedded Meteobridge", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "smartbedded meteobridge vm", "fixed": ["6.2"], "affected": "< 6.2", "ecosystem": "vendor"}, {"name": "smartbedded meteobridge firmware", "fixed": ["6.2"], "affected": "< 6.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "iot", "meteobridge", "self-hosted"]
not_affected_if: ["no-meteobridge-device"]
published_at: "2025-05-21T16:15:33+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-4008", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4008", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# The Meteobridge web interface let meteobridge administrator manage their weather station data collection and…

Smartbedded Meteobridge is a weather station data bridge, and this flaw lets a remote unauthenticated attacker inject OS commands. Successful exploitation gives arbitrary command execution as root on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Smartbedded Meteobridge affected ? fixed ?
- vendor:smartbedded meteobridge vm affected < 6.2 fixed 6.2
- vendor:smartbedded meteobridge firmware affected < 6.2 fixed 6.2

## How to check

Identify any Meteobridge devices on your network and note their firmware version; the sources do not say which version is affected.

## Fix

Apply the vendor mitigation per Smartbedded's instructions, or disconnect the device from the internet if no mitigation exists (per CISA guidance to discontinue use if mitigations are unavailable).

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-4008
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-4008

## From the sources

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.

This web interface exposes an endpoint that is vulnerable to command injection.

Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_