All news with #meteobridge tag

Fri, October 3, 2025

CISA Adds Meteobridge Command Injection CVE-2025-4008

#KEV Added #Active Exploitation #Security Advisory #Patch #RCE #Meteobridge

⚠️ CISA has added a high-severity command injection flaw, CVE-2025-4008, affecting Smartbedded Meteobridge to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root via a vulnerable /cgi-bin/template.cgi endpoint that improperly uses eval calls. ONEKEY reported the issue and Meteobridge issued a fix in version 6.2 on May 13, 2025.