---
title: "Meteobridge CVE-2025-4008: Unauthenticated Root Command Exec"
url: https://erroneo.us/security/briefs/meteobridge-cve-2025-4008-command-injection/
description: "Weather-station gateway Meteobridge 6.1 and older runs commands as root via an unauthenticated CGI script; exploited, in KEV. Fixed in 6.2. Update, unexpose."
type: security-brief
section: "Security Digest"
date_published: 2025-05-13
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-4008"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Meteobridge CVE-2025-4008: Unauthenticated Root Command Exec

**Verdict: Check exposure.** A small, mostly hobbyist install base and a fix since May 2025 keep the blast radius narrow, but any Meteobridge still on 6.1 or older, or one that was port-forwarded to the internet, should be updated and checked.

- **Who must act:** Owners of Meteobridge devices or VMs on version 6.1 or earlier, and anyone who exposes a Meteobridge web interface to the internet through port forwarding or remote login.
- **Who can relax:** Owners already on 6.2 or later whose Meteobridge is reachable only from the local network.
- **Affected:** Smartbedded Meteobridge 6.1 and earlier (firmware and VM editions)
- **Fixed:** Meteobridge 6.2 (released May 13, 2025) and later
- **CVEs:** CVE-2025-4008
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the Meteobridge version in its web interface; anything below 6.2 is vulnerable.
2. Update: set the version option on the System - Administration tab to 'newest on boot' and reboot; devices out of update support should reboot with any setting other than 'use installed version'.
3. Remove router port forwards and other internet access to the Meteobridge web interface.
4. Put the device on an isolated network segment, away from workstations and servers.
5. If it was internet-exposed while on 6.1 or older, change its admin password and any weather-service upload keys stored on it.

### How to check if you are affected

- Router or firewall logs showing inbound internet connections to the Meteobridge web port
- Any logged request to /public/template.cgi whose templatefile parameter contains $( or backticks
- Outbound connections from the Meteobridge to hosts other than your weather services, or unexplained configuration changes

## What happened

Meteobridge, from Smartbedded, connects personal weather stations to online weather networks. It runs on small TP-Link, D-Link and ASUS routers, on Smartbedded's own PRO, PRO2 and NANO hardware, and as a VM. In February 2025, ONEKEY Research Lab found a command injection in its web interface. The [ONEKEY advisory](https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008) explains how it works:

- The `template.cgi` script passes the `templatefile` query parameter, unsanitized, into an `eval`.
- Under `/cgi-bin/` the script sits behind basic authentication. A copy at `/public/template.cgi` does not.
- So a request such as `/public/template.cgi?templatefile=$(command)` runs commands as root without a login.

Because the attack is a plain GET, ONEKEY notes, a malicious web page opened by anyone on the same network can fire it with an image tag.

Disclosure was rocky. ONEKEY emailed the vendor four times between February 25 and April 15. A forum post it made on April 10 was deleted the next day along with its account. ONEKEY then escalated to Germany's BSI. Smartbedded shipped [version 6.2 on May 13, 2025](https://forum.meteohub.de/viewtopic.php?t=18687) with a note that did not describe the bug. The CVE followed on May 21.

CISA added CVE-2025-4008 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008) on October 2, 2025, alongside old Shellshock, Jenkins and Juniper ScreenOS bugs. As [The Hacker News](https://thehackernews.com/2025/10/cisa-flags-meteobridge-cve-2025-4008.html) noted at the time, there were no public reports of how it was being exploited. We found none as of Oct 23, 2026; who is exploiting it is not disclosed.

## Who is affected

Meteobridge 6.1 and earlier is affected. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-4008) lists both the firmware and the VM edition. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-4008) carries ONEKEY's CVSS 4.0 score of 8.7, with an adjacent-network attack vector, and NVD rates it CVSS 3.1 8.8. ONEKEY found roughly 70 to 130 devices exposed on Shodan at any time.

## Do you really need to act?

Only if you run Meteobridge, but then yes. A root shell on a box inside your network is a ready foothold and a good botnet node. The vendor says a LAN-only device without remote access is safe. The browser-triggered route weakens that: a pre-6.2 device can still be hit through someone's browser on the same network. On 6.2 or later, with no port forward, there is nothing more to do.

## What to do now

1. Check the version shown in the Meteobridge web interface. Anything below 6.2 is vulnerable.
2. Update. If you are in the update program, set the version option on the System - Administration tab to "newest on boot" and reboot. Devices out of update support should reboot with any setting other than "use installed version", per the vendor.
3. Remove router port forwards and remote access to the web interface. Smartbedded says exposing it to the internet "is NOT recommended".
4. Move the device to an isolated VLAN or IoT network.
5. If it was exposed while vulnerable, change its admin password and any upload keys stored on it, and consider a factory reset.

## How to tell if you were hit

The device keeps little useful logging, so look around it. Check router or firewall logs for inbound internet connections to its web port. Check any proxy or IDS logs for `/public/template.cgi` requests whose `templatefile` parameter contains `$(` or backticks. Look for outbound traffic from the Meteobridge to anything other than your weather services. Unexplained configuration changes, reboots or high load are also warning signs.

## Timeline

- Feb 25, 2025 — ONEKEY first notifies Smartbedded.
- Apr 27, 2025 — ONEKEY escalates to the German BSI.
- May 13, 2025 — Meteobridge 6.2 is released with the fix.
- May 21, 2025 — CVE-2025-4008 is published.
- May 26, 2025 — ONEKEY publishes its advisory.
- Oct 2, 2025 — CISA adds it to KEV (due Oct 23).

## Sources

1. [Smartbedded — Newly released Version 6.2 fixes an application security risk](https://forum.meteohub.de/viewtopic.php?t=18687)
2. [ONEKEY — Security advisory: remote command execution on Smartbedded Meteobridge (CVE-2025-4008)](https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008)
3. [CVE record — CVE-2025-4008](https://www.cve.org/CVERecord?id=CVE-2025-4008)
4. [NVD — CVE-2025-4008](https://nvd.nist.gov/vuln/detail/CVE-2025-4008)
5. [CISA — Known Exploited Vulnerabilities: CVE-2025-4008](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008)
6. [The Hacker News — CISA flags Meteobridge CVE-2025-4008](https://thehackernews.com/2025/10/cisa-flags-meteobridge-cve-2025-4008.html)

---
Source page: https://erroneo.us/security/briefs/meteobridge-cve-2025-4008-command-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt