Organizations Warned of Exploited Meteobridge Vulnerability

According to CISA, a Meteobridge vulnerability patched in May has been exploited in attacks and added to the Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2025-4008 with a CVSS score of 8.7, allows remote unauthenticated attackers to execute arbitrary commands via a CGI shell script in the public web interface folder, where user‑controlled input is not sanitised and an eval call is used.

Around 100 Meteobridge devices are reportedly accessible from the public web, increasing exposure to potential attacks. Exploitation can occur via a curl command and a GET request without authentication or a custom header, with a PoC and technical details published by Onekey and a May 13 update from MeteoBridge 6.2 addressing an application security risk.

CISA warns that threat actors have exploited the flaw and urges federal agencies to remediate within three weeks, while the KEV list was expanded to include this and other older vulnerabilities.