CVE-2025-54863
Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could potentially compromise airport operations. Additionally, attackers could flood the system with false alerts, leading to a denial-of-service condition and significant disruption to airport operations. Unauthorized remote control over aviation weather monitoring and data manipulation could result in incorrect flight planning and hazardous takeoff and landing conditions.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.62%
- CWE
- CWE-522
- Published
- 2025-11-04
- Last modified
- 2026-03-12
Affected products
- Radiometrics VizAir
Weakness type
Related vulnerabilities
- CVE-2026-69805 — .NET Elevation of Privilege Vulnerability
- CVE-2026-64918 — Microsoft Office Spoofing Vulnerability
- CVE-2026-81381 — GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-77909 — Azure CycleCloud Information Disclosure Vulnerability
- CVE-2026-82070 — Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
- CVE-2026-86600 — Workload identity attestation generated before login host validation in Snowflake drivers
- CVE-2026-86726 — AVideo through 29.0 Information Disclosure via restreamsActive.json.php
- CVE-2026-61516 — Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint