Description
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| National Oceanic and Atmospheric Administration (NOAA) | Live Access Server (LAS) | 8 | 8 |
Advisories 1
- VA-26-015-01 NOAA PMEL Live Access Server (LAS) command injection CISA ICS & IT advisories · Jan 15, 2026