Critical · published November 4, 2025
🚨 A publicly accessible config file is the gateway for attackers to mess with aviation weather data! 🔥 Think of it like leaving an unlocked control room at an airport, where anyone can walk in and alter flight data — it’s a recipe for disaster! ✈️ If exploited, an attacker can remotely manipulate weather data, creating chaos that could jeopardize flights and safety. Imagine false alerts flooding the system, leading to delays or cancellations, and worst of all, giving pilots incorrect information for takeoffs and landings — absolutely devastating for airport operations!
Think of it like leaving an unlocked control room at an airport, where anyone can walk in and alter flight data — it’s a recipe for disaster! ✈️ This vulnerability in Radiometrics VizAir exposes the REST API key through an unsecured configuration file, allowing unauthorized access to alter system settings and manipulate critical meteorological data.
If exploited, an attacker can remotely manipulate weather data, creating chaos that could jeopardize flights and safety. Imagine false alerts flooding the system, leading to delays or cancellations, and worst of all, giving pilots incorrect information for takeoffs and landings — absolutely devastating for airport operations! Immediately secure the configuration file to restrict access to authorized users only. Consider implementing encryption for sensitive keys and regularly review access controls. Don’t forget to monitor the system for unusual activities and keep your software updated! You've got this! Take these steps to safeguard operations and keep the skies safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| radiometrics/vizair | < 2025-08 | 2025-08 |