CISA Flags Meteobridge CVE-2025-4008 Flaw as Actively Exploited in the Wild

CISA has added the high-severity vulnerability CVE-2025-4008 in Smartbedded Meteobridge to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. The flaw is a command injection vulnerability in the Meteobridge web interface that could allow remote unauthenticated attackers to gain arbitrary code execution with elevated privileges (root) on affected devices, with a CVSS score of 8.7.

According to ONEKEY, which discovered and reported the issue in late February 2025, the web interface exposes a template.cgi script via /cgi-bin/template.cgi that is vulnerable due to insecure eval usage, enabling arbitrary command execution through specially crafted requests.

The vulnerability can be exploited by unauthenticated attackers because the CGI script is hosted in a public directory without authentication, and remote exploitation via a malicious webpage is possible since it uses a GET request without special headers or tokens. There are currently no public reports detailing active in-the-wild exploitation, and Meteobridge version 6.2, released on 13 May 2025, addressed the issue; FCEB agencies are urged to apply updates by 23 October 2025.