Description
Smartbedded MeteoBridge 是一个小型设备，可将个人气象站连接到公共天气网络，如 Weather Underground。它允许用户将微气候数据上传到互联网并进行共享。Meteobridge 的 Web 界面通过 CGI shell 脚本和 C 语言编写的 Web 应用程序管理气象站数据。然而，该界面暴露了一个易受命令注入攻击的终端节点，未经身份验证的远程攻击者可以在受影响的设备上以 root 权限执行任意命令。
Meteobridge /public/template.cgi 代码执行漏洞（CVE-2025-4008）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008
https://nvd.nist.gov/vuln/detail/CVE-2025-4008
https://thehackernews.com/2025/10/cisa-flags-meteobridge-cve-2025-4008.html
https://forum.meteohub.de/viewtopic.php?t=18687
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4008
https://pentest-tools.com/vulnerabilities-exploits/meteobridge-61-remote-code-execution_28999
https://github.com/advisories/GHSA-g7h8-28jj-qxmf
https://www.tenable.com/cve/CVE-2025-4008
https://www.sentinelone.com/vulnerability-database/cve-2025-4008/
https://access.redhat.com/security/cve/cve-2025-4008
https://www.runzero.com/blog/smartbedded-meteobridge/
https://www.securityweek.com/organizations-warned-of-exploited-meteobridge-vulnerability/
https://cyberpress.org/meteobridge-web-interface/