CVE-2025-61956CWE-306

CVE-2025-61956

Critical · published November 4, 2025

CVSS v3.1
10.0
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

🚨 A massive security gap lets anyone mess with critical flight operations in Radiometrics VizAir—no authentication needed! 🔥 This vulnerability is like leaving the cockpit door wide open and letting any passerby adjust the instruments—truly alarming! Imagine an unqualified person switching runways or altering weather data while pilots and air traffic controllers are none the wiser. An attacker could wreak absolute havoc by accessing and modifying vital configurations, leading to unsafe runway settings and incorrect meteorological data. This could mislead air traffic control and pilots, causing chaos in flight planning and potentially endangering lives. We’re talking about a serious threat to aviation safety!

Put simply

This vulnerability is like leaving the cockpit door wide open and letting any passerby adjust the instruments—truly alarming! Imagine an unqualified person switching runways or altering weather data while pilots and air traffic controllers are none the wiser. The vulnerability arises from missing authentication checks for admin functions and API requests in Radiometrics VizAir, allowing unauthorized users to alter critical settings without restriction.

What to do

An attacker could wreak absolute havoc by accessing and modifying vital configurations, leading to unsafe runway settings and incorrect meteorological data. This could mislead air traffic control and pilots, causing chaos in flight planning and potentially endangering lives. We’re talking about a serious threat to aviation safety! Immediately update to the latest secured version of Radiometrics VizAir that includes proper authentication mechanisms. Conduct a thorough audit of current configurations and ensure that only authorized personnel have access to critical functions. Establish a robust monitoring system to detect unauthorized changes. You can tackle this head-on! Follow these steps, and you'll strengthen the security of your aviation systems in no time! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00745 · 54.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-11-04T22:16Z
Affected products (1)
ProductVersionsFixed in
radiometrics/vizair< 2025-082025-08
References (2)
EPSS history
Timeline
  • 04 NOV 16:15Z
    Missing Authentication for Critical Function in Radiometrics VizAir
    cvelistv5