Critical authentication vulnerabilities reported in Radiometrics VizAir aviation weather system
Take action: If you use Radiometrics VizAir aviation weather monitoring systems, verify with Radiometrics that your system received the automatic security updates that fix three maximum-severity flaws. And make sure that your systems are isolated from the internet and accessible only from trusted networks.
Learn More
CISA is reporting three critical security vulnerabilities affecting Radiometrics VizAir, an aviation weather monitoring system used at airports worldwide. These flaws could enable attackers to manipulate weather parameters, mislead air traffic control and pilots, and cause disruption to airport operations with potentially catastrophic consequences for flight safety.
Vulnerabilities summary:
- CVE-2025-61945 (CVSS score 10) - Missing Authentication for Critical Function. This vulnerability allows any remote attacker to access the admin panel of the VizAir system without authentication.
- CVE-2025-54863 (CVSS score 10) - Insufficiently Protected Credentials. This vulnerability exposes the system's REST API key through a publicly accessible configuration file, allowing attackers to remotely alter weather data and configurations, automate attacks against multiple VizAir instances, extract sensitive meteorological data, flood the system with false alerts leading to denial-of-service conditions, and gain unauthorized remote control over aviation weather monitoring systems.
- CVE-2025-61956 (CVSS score 10) - Missing Authentication for Critical Function. This vulnerability allows attackers to modify configurations without authentication, manipulate active runway settings to mislead air traffic control and pilots, and alter meteorological data that could cause inaccurate flight planning and hazardous takeoff and landing conditions.
Affected versions are all versions of Radiometrics VizAir prior to August 2025.
Radiometrics has performed updates on all affected VizAir systems and has resolved these vulnerabilities. According to the advisory, no further action is required from users as the patches have been deployed to all systems. CISA still recommends that organizations take additional defensive measures to minimize risk of exploitation, including minimizing network exposure for all control system devices and ensuring they are not accessible from the internet, locating control system networks and remote devices behind firewalls and isolating them from business networks.
