Skip to content
OpenAdvisories
Critical ICSA-25-308-04 3 CVEs

Radiometrics VizAir

Published Nov 4, 2025 · Updated Nov 4, 2025

Vendor: Radiometrics Product: VizAir

Summary

Successful exploitation of these vulnerabilities could allow attackers to manipulate critical weather parameters and runway settings, mislead air traffic control and pilots, extract sensitive meteorological data, and cause significant disruption to airport operations, leading to hazardous flight conditions.

Vulnerabilities 3

  • Critical 10.0
    CVE-2025-54863

    Insufficiently Protected Credentials in Radiometrics VizAir

    Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sens…

    Radiometrics VizAir
  • Critical 10.0
    CVE-2025-61945

    Missing Authentication for Critical Function in Radiometrics VizAir

    Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, w…

    Radiometrics VizAir
  • Critical 10.0
    CVE-2025-61956

    Missing Authentication for Critical Function in Radiometrics VizAir

    Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading …

    Radiometrics VizAir

Revision history

  1. #1

    Initial Publication

References