CVSS 4.0
8.7 highCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NCVE-2025-4008
High (8.7) in Smartbedded Meteobridge. In CISA KEV since 2025-10-02. EPSS 93% chance of exploitation in the next 30 days.
The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.
This web interface exposes an endpoint that is vulnerable to command injection.
Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
Severity
CVSS 3.1
8.8 highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- EPSS
- 93% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2025-10-02, due 2025-10-23
- CWEs
- CWE-77, CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- smartbedded:meteobridge_firmware
- smartbedded:meteobridge_vm