Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a high-severity command injection vulnerability in Smartbedded Meteobridge devices, tracked as CVE-2025-4008, and added it to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. This vulnerability, with a CVSS score of 8.7, resides in the Meteobridge web interface, specifically within the publicly accessible 'template.cgi' script, which is written in CGI shell scripts and C. The flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges by sending specially crafted GET requests to the vulnerable endpoint. Security researchers from ONEKEY discovered that the vulnerability stems from insecure use of eval calls in the CGI script, enabling attackers to inject commands without any authentication or custom headers. The attack can be triggered simply by enticing a victim to visit a malicious webpage or by directly targeting exposed devices, as the CGI script is accessible without authentication. CISA’s advisory highlights that this vulnerability is being actively exploited in the wild, although no detailed public reports of exploitation techniques have been released. The vulnerability was addressed by Smartbedded in Meteobridge version 6.2, released on May 13, 2025, and users are strongly urged to update to this version to mitigate the risk. CISA’s inclusion of CVE-2025-4008 in the KEV catalog mandates that Federal Civilian Executive Branch (FCEB) agencies remediate the vulnerability by a specified due date, as per Binding Operational Directive (BOD) 22-01. The directive also encourages all organizations, not just federal agencies, to prioritize patching of KEV-listed vulnerabilities to reduce exposure to cyberattacks. The vulnerability is considered a significant risk to both federal and enterprise environments due to its ease of exploitation and the potential for attackers to gain full control of affected devices. Alongside Meteobridge, CISA’s recent KEV catalog update also included critical vulnerabilities in products from GNU Bash, Juniper, Samsung, and Jenkins, underscoring the ongoing threat posed by actively exploited flaws. The technical details provided by security researchers demonstrate that exploitation does not require advanced skills, increasing the urgency for immediate remediation. Organizations using Meteobridge devices should verify their firmware version and apply the latest updates without delay. The public advisories and catalog updates serve as a warning to the broader cybersecurity community about the importance of monitoring and addressing vulnerabilities that are known to be under active attack. Failure to remediate CVE-2025-4008 could result in unauthorized access, data compromise, or further exploitation within affected networks. CISA continues to monitor and update the KEV catalog as new evidence of exploitation emerges, reinforcing the need for proactive vulnerability management.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Following the KEV catalog update, CISA required federal civilian agencies to remediate the newly listed vulnerabilities by this deadline under Binding Operational Directive 22-01.
CISA added five known exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including Smartbedded Meteobridge CVE-2025-4008 alongside flaws affecting Samsung mobile devices, Jenkins, Juniper ScreenOS, and GNU Bash. The addition indicates evidence of active exploitation in the wild.
Smartbedded released Meteobridge version 6.2 to fix CVE-2025-4008, a high-severity command injection flaw in the template.cgi web interface that could allow unauthenticated remote code execution as root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcethecyberthrone.in
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Smartbedded Meteobridge devices have been found to contain a critical command injection vulnerability, tracked as CVE-2025-4008, which affects the management web interface endpoint /public/template.cgi. The flaw arises from improper neutralization of user-supplied input, which is parsed and used unsanitized in an eval call, allowing for remote (adjacent), unauthenticated attackers to execute arbitrary commands with root privileges. This vulnerability has been rated as high severity, with a CVSS score of 8.8, and there is confirmed evidence of active exploitation in the wild. Devices running Meteobridge versions prior to 6.2 are vulnerable to this exploit, making a significant number of systems potentially at risk if not updated. Successful exploitation could result in complete system compromise, giving attackers full control over the affected device. In response, Smartbedded has released an update, and users are strongly encouraged to upgrade to version 6.2 or later to mitigate the risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recognized the seriousness of this vulnerability by adding CVE-2025-4008 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the need for immediate remediation. CISA’s inclusion of this flaw in the KEV catalog underscores the active threat it poses to organizations and individuals using Meteobridge devices. Security researchers have provided guidance on how to identify potentially vulnerable systems, including specific queries that can be used to locate affected assets within network inventories. The vulnerability is part of a broader set of flaws added to the KEV catalog, but CVE-2025-4008 is specifically noted for its active exploitation and potential for severe impact. Organizations are advised to prioritize patching and to review their inventories for any exposed Meteobridge devices. The disclosure and subsequent response demonstrate the ongoing risks associated with IoT and network management devices, which often have elevated privileges and are attractive targets for attackers. The rapid addition of this vulnerability to the KEV catalog reflects the urgency with which defenders must act to prevent compromise. The technical details of the vulnerability, including the use of unsanitized input in an eval call, highlight the importance of secure coding practices in web interfaces. The incident serves as a reminder for organizations to maintain up-to-date patching processes and to monitor advisories from both vendors and government agencies. Failure to address this vulnerability could result in attackers leveraging compromised Meteobridge devices as footholds for further attacks within a network. The situation remains dynamic, with ongoing monitoring recommended to detect any signs of exploitation or compromise related to this vulnerability.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog to include several new security flaws that have been actively exploited in the wild. The newly added vulnerabilities span a wide range of products and platforms, including GNU Bash, Smartbedded Meteobridge, Juniper ScreenOS, Jenkins, Samsung mobile devices, and several legacy products from Mozilla, Microsoft, Linux, and Oracle. Among the most notable is the GNU Bash command injection flaw (CVE-2014-6278), a Shellshock-related vulnerability that allows remote attackers to execute arbitrary code on affected Linux and Unix systems. Juniper ScreenOS is affected by an improper authentication vulnerability (CVE-2015-7755), which can grant attackers administrative access via TELNET or SSH. Jenkins is impacted by a remote code execution bug (CVE-2017-1000353) that enables unauthenticated attackers to bypass deserialization safeguards through crafted Java objects. The Smartbedded Meteobridge device is vulnerable to a command injection issue (CVE-2025-4008), allowing remote, unauthenticated users to execute root-level commands through its web interface. Samsung mobile devices are at risk due to an out-of-bounds write flaw (CVE-2025-21043) in libimagecodec.quram.so, which can be exploited remotely for arbitrary code execution. CISA also added vulnerabilities such as CVE-2010-3765 (Mozilla products), CVE-2010-3962 (Microsoft Internet Explorer), CVE-2011-3402 and CVE-2013-3918 (Microsoft Windows), CVE-2021-22555 (Linux Kernel), CVE-2021-43226 (Microsoft Windows), and CVE-2025-61882 (Oracle E-Business Suite), all of which have evidence of active exploitation. Federal agencies have been directed to remediate these vulnerabilities by a specified deadline to comply with Binding Operational Directive (BOD) 22-01, which mandates timely mitigation of known exploited vulnerabilities. The directive is designed to reduce significant risk to the federal enterprise by ensuring that actively exploited vulnerabilities are addressed promptly. While BOD 22-01 is mandatory for Federal Civilian Executive Branch agencies, CISA strongly encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities as part of their vulnerability management programs. The addition of these vulnerabilities underscores the persistent threat posed by both legacy and modern software flaws, and highlights the importance of continuous monitoring and rapid response to newly discovered exploits. CISA’s ongoing updates to the KEV Catalog serve as a critical resource for organizations seeking to defend against active cyber threats. The agency’s alert emphasizes that these vulnerabilities are frequent attack vectors for malicious actors and pose significant risks if left unaddressed. Organizations are advised to consult the KEV Catalog regularly and implement recommended mitigations to protect their networks. The inclusion of both recent and older vulnerabilities in the catalog reflects the reality that unpatched legacy systems remain a significant target for attackers. CISA’s proactive approach aims to drive widespread remediation efforts across both public and private sectors. The agency will continue to update the KEV Catalog as new evidence of exploitation emerges, reinforcing the need for vigilance and timely patching in cybersecurity operations.
Jun 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding five new security flaws that are currently under active exploitation. The vulnerabilities include CVE-2021-21311 affecting Adminer, CVE-2025-20352 impacting Cisco IOS and IOS XE, CVE-2025-10035 in Fortra GoAnywhere MFT, CVE-2025-59689 in Libraesva Email Security Gateway, and CVE-2025-32463 in Sudo. The Adminer flaw is a Server-Side Request Forgery (SSRF) vulnerability that allows attackers to manipulate URL parameters, potentially enabling unauthorized access to internal resources and facilitating lateral movement within networks. The Cisco IOS and IOS XE vulnerability is a stack-based buffer overflow in the SNMP subsystem, which can be exploited by sending crafted SNMP packets, leading to denial of service or remote code execution as root, depending on attacker privileges. Fortra GoAnywhere MFT is affected by a critical deserialization vulnerability in its License Servlet, which could allow attackers to execute arbitrary code. Libraesva ESG suffers from a command injection vulnerability, and Sudo is impacted by a flaw involving the inclusion of functionality from an untrusted control sphere. CISA’s Product Security Incident Response Team (PSIRT) has confirmed that these vulnerabilities are being actively exploited in the wild. The addition of these flaws to the KEV Catalog is based on credible evidence of exploitation, and CISA has issued a Binding Operational Directive (BOD) 22-01 requiring Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities by specified deadlines. The directive aims to reduce significant risk to federal networks, but CISA also strongly urges all organizations, not just federal agencies, to prioritize remediation of these vulnerabilities as part of their vulnerability management programs. The vulnerabilities span a range of critical systems, including database management tools, network operating systems, email security gateways, and managed file transfer platforms, highlighting the broad attack surface targeted by malicious actors. The Adminer SSRF vulnerability, with a CVSS score of 7.2, affects versions 4.0.0 to just before 4.7.9, while the Cisco IOS/IOS XE flaw, with a CVSS score of 7.7, impacts all devices with SNMP enabled. The Fortra GoAnywhere MFT vulnerability is rated as critical with a CVSS score of 10.0, underscoring the urgency of remediation. CISA’s ongoing updates to the KEV Catalog reflect the evolving threat landscape and the need for organizations to remain vigilant against actively exploited vulnerabilities. Organizations are encouraged to consult the KEV Catalog regularly and implement timely patches to mitigate the risk of compromise. The inclusion of these vulnerabilities in the KEV Catalog serves as a warning to both public and private sector entities about the heightened risk posed by these flaws. Failure to address these vulnerabilities could result in significant operational disruptions or unauthorized access to sensitive systems. CISA’s alert emphasizes the importance of proactive vulnerability management and cross-sector collaboration to defend against active cyber threats.
Jun 29, 2026