CyberHappenings logo
☰
Home Browse About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Meteobridge Command Injection Vulnerability Exploited in the Wild

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a high-severity command injection vulnerability (CVE-2025-4008) in Smartbedded Meteobridge as actively exploited in the wild. The flaw, with a CVSS score of 8.7, allows remote unauthenticated attackers to execute arbitrary code with elevated privileges on affected devices. The vulnerability resides in the Meteobridge web interface, specifically in the template.cgi script, which is vulnerable due to insecure use of eval calls. The flaw was discovered and reported by ONEKEY in February 2025 and was addressed in Meteobridge version 6.2, released on May 13, 2025. The vulnerability can be exploited through specially crafted requests and malicious webpages, posing a significant risk to users. Federal Civilian Executive Branch (FCEB) agencies are required to apply necessary updates by October 23, 2025, to mitigate the risk.

Timeline

  1. 03.10.2025 11:23 1 articles · 2h ago

    CISA Flags Meteobridge Command Injection Vulnerability as Actively Exploited

    On October 3, 2025, CISA added the high-severity command injection vulnerability (CVE-2025-4008) in Smartbedded Meteobridge to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, with a CVSS score of 8.7, allows remote unauthenticated attackers to execute arbitrary code with elevated privileges on affected devices. The vulnerability was discovered in February 2025 and addressed in Meteobridge version 6.2, released on May 13, 2025. FCEB agencies are required to apply updates by October 23, 2025, to mitigate the risk.

    Show sources
    Open in new tab

Information Snippets