CVE-2025-54863
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Radiometrics VizAir exposes the system's REST API key through a publicly accessible configuration file. Attackers can remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data.
Risk Assessment
This could compromise airport operations, enable flooding with false alerts causing denial of service, and lead to incorrect flight planning and hazardous takeoff and landing conditions.
Recommendation
Immediately restrict public access to the configuration file, rotate the API key, and limit access to the REST API.
Other vulnerabilities in Radiometrics VizAir
See all- CVE-2025-61956Critical
Radiometrics VizAir lacks authentication mechanisms for critical functions such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and meteorological data, misleading air traffic control and pilots.
- CVE-2025-61945Critical
Radiometrics VizAir is vulnerable to any remote attacker accessing the admin panel without authentication. The attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, potentially disabling vital alerts and manipulating runway assignments.
Original NVD description (English source)
Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could potentially compromise airport operations. Additionally, attackers could flood the system with false alerts, leading to a denial-of-service condition and significant disruption to airport operations. Unauthorized remote control over aviation weather monitoring and data manipulation could result in incorrect flight planning and hazardous takeoff and landing conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS