Radiometrics VizAir vulnerabilities

Radiometrics VizAir lacks authentication mechanisms for critical functions such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and meteorological data, misleading air traffic control and pilots.

Radiometrics VizAir is vulnerable to any remote attacker accessing the admin panel without authentication. The attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, potentially disabling vital alerts and manipulating runway assignments.

Radiometrics VizAir exposes the system's REST API key through a publicly accessible configuration file. Attackers can remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data.