What’s Vulnerable › Vulnerabilities

CVE-2025-61945: Missing Authentication for Critical Function in Radiometrics VizAir

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-04 · updated 2026-10-18
• Weakness: CWE-306

Description

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weather forecasting and flight safety. This unauthorized access could result in the disabling of vital alerts, causing hazardous conditions for aircraft, and manipulating runway assignments, which could result in mid-air conflicts or runway incursions.

Affected products

• Radiometrics VizAir: before 2025-08 — fixed in 2025-08

How to fix

Upgrade to a fixed version: Radiometrics VizAir 2025-08. Check the vendor advisory for mitigations.

References

• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-308-04.json
• https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-04

Get alerted when CVE-2025-61945 or the next vulnerability affects your stack