CVE-2025-61945CWE-306

CVE-2025-61945

Critical · published November 4, 2025

CVSS v3.1
10.0
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

🚨 A remote attacker can waltz right into the VizAir admin panel without a password — that’s like leaving the cockpit door wide open during a flight! 🔥 Think of the VizAir system as a bustling airport control tower. If an unauthorized individual gets in, it’s like a rogue air traffic controller reassigning flights without any oversight, leading to potential mid-air collisions or runway chaos. If exploited, an attacker could manipulate critical weather parameters, possibly disabling crucial alerts that keep aircraft safe. Imagine planes taking off in hazardous conditions or being misdirected to the wrong runway — the stakes are nothing short of catastrophic!

Put simply

Think of the VizAir system as a bustling airport control tower. If an unauthorized individual gets in, it’s like a rogue air traffic controller reassigning flights without any oversight, leading to potential mid-air collisions or runway chaos. This vulnerability allows remote attackers to gain unauthorized access to the VizAir admin panel, enabling them to alter key weather parameters crucial for flight safety and accurate forecasting.

What to do

If exploited, an attacker could manipulate critical weather parameters, possibly disabling crucial alerts that keep aircraft safe. Imagine planes taking off in hazardous conditions or being misdirected to the wrong runway — the stakes are nothing short of catastrophic! Immediate action is necessary! Secure the admin panel by implementing strict authentication measures, such as multi-factor authentication (MFA), and ensure only authorized personnel can access critical settings. Conduct a thorough security audit to tighten overall controls. You've got this! Take swift action, and your systems will be safer in no time. 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00769 · 55.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-11-04T22:16Z
Affected products (1)
ProductVersionsFixed in
radiometrics/vizair< 2025-082025-08
References (2)
EPSS history
Timeline
  • 04 NOV 16:10Z
    Missing Authentication for Critical Function in Radiometrics VizAir
    cvelistv5