Critical · published November 4, 2025
🚨 A massive security gap lets anyone mess with critical flight operations in Radiometrics VizAir—no authentication needed! 🔥 This vulnerability is like leaving the cockpit door wide open and letting any passerby adjust the instruments—truly alarming! Imagine an unqualified person switching runways or altering weather data while pilots and air traffic controllers are none the wiser. An attacker could wreak absolute havoc by accessing and modifying vital configurations, leading to unsafe runway settings and incorrect meteorological data. This could mislead air traffic control and pilots, causing chaos in flight planning and potentially endangering lives. We’re talking about a serious threat to aviation safety!
This vulnerability is like leaving the cockpit door wide open and letting any passerby adjust the instruments—truly alarming! Imagine an unqualified person switching runways or altering weather data while pilots and air traffic controllers are none the wiser. The vulnerability arises from missing authentication checks for admin functions and API requests in Radiometrics VizAir, allowing unauthorized users to alter critical settings without restriction.
An attacker could wreak absolute havoc by accessing and modifying vital configurations, leading to unsafe runway settings and incorrect meteorological data. This could mislead air traffic control and pilots, causing chaos in flight planning and potentially endangering lives. We’re talking about a serious threat to aviation safety! Immediately update to the latest secured version of Radiometrics VizAir that includes proper authentication mechanisms. Conduct a thorough audit of current configurations and ensure that only authorized personnel have access to critical functions. Establish a robust monitoring system to detect unauthorized changes. You can tackle this head-on! Follow these steps, and you'll strengthen the security of your aviation systems in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| radiometrics/vizair | < 2025-08 | 2025-08 |