CVE-2025-61956
CriticalCVSS 10.0Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Radiometrics VizAir lacks authentication mechanisms for critical functions such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and meteorological data, misleading air traffic control and pilots.
Risk Assessment
Missing authentication allows manipulation of critical airport operational data, which can lead to inaccurate flight planning and risks to air traffic safety.
Recommendation
Implement authentication and authorization for administrative and API access, and restrict network access to the VizAir system.
Other vulnerabilities in Radiometrics VizAir
See all- CVE-2025-61945Critical
Radiometrics VizAir is vulnerable to any remote attacker accessing the admin panel without authentication. The attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, potentially disabling vital alerts and manipulating runway assignments.
- CVE-2025-54863Critical
Radiometrics VizAir exposes the system's REST API key through a publicly accessible configuration file. Attackers can remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data.
Original NVD description (English source)
Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control (ATC) and pilots. Additionally, manipulated meteorological data could mislead forecasters and ATC, causing inaccurate flight planning.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS