BaseFortify

Publication date: 2025-11-04

Last updated on: 2025-11-12

Assigner: ICS-CERT

Description

Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control (ATC) and pilots. Additionally, manipulated meteorological data could mislead forecasters and ATC, causing inaccurate flight planning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-04

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-04

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61956

EUVD

EUVD-2025-37762

Affected Vendors & Products

Vendor	Product	Version / Range
radiometrics	vizair	to 2025-08 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in Radiometrics VizAir is due to a lack of authentication mechanisms for critical functions like admin access and API requests. This means attackers can modify system configurations without needing to authenticate, potentially changing active runway settings and meteorological data. Such unauthorized changes can mislead air traffic control and pilots, as well as forecasters, leading to inaccurate flight planning.

Impact Analysis

The vulnerability can have severe impacts by allowing attackers to manipulate critical aviation data and configurations. This can mislead air traffic control and pilots about runway status and weather conditions, potentially causing unsafe flight operations and increasing the risk of accidents or disruptions in air traffic management.

Hi! I’m here to help you understand CVE-2025-61956. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70