CVE-2025-54863

The REST API key, which should be protected as an authentication secret, is stored in a publicly accessible configuration file without requiring any authentication. An attacker obtaining this key can fully utilize the system's REST API interface as if they were an authorized user. This enables remote modification of weather data and system configuration, extraction of sensitive meteorological data, flooding the system with false alerts (leading to a denial-of-service state), and automation of attacks against multiple simultaneously running VizAir instances.

An attacker can remotely manipulate weather data and system configuration, which may lead to incorrect flight planning and create dangerous conditions during takeoffs and landings. It is also possible to cause airport operational disruptions by flooding the system with false weather alerts (denial-of-service) and theft of sensitive meteorological data.

Apply patches available from the vendor according to the references. Additional security recommendations for the OT/ICS environment may be found in the CISA advisory available at: https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-04. As immediate measures, consider isolating the system from the public network, implementing firewall rules restricting access to the configuration file, and immediately rotating the API key.

Radiometrics VizAir — versions indicated in the vendor references (CISA advisory ICSA-25-308-04)