CVE-2025-61945 Missing Authentication for Critical Function in Radiometrics VizAir
Remote attackers can access the admin panel without authentication to modify critical weather parameters, potentially compromising flight safety.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61945?
CVE-2025-61945 is a critical missing authorization vulnerability in Radiometrics VizAir, published on 4 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weather forecasting and flight safety. This unauthorized access could result in the disabling of vital alerts, causing hazardous conditions for aircraft, and manipulating runway assignments, which could result in mid-air conflicts or runway incursions.
Weakness: CWE-306
Which versions are affected by CVE-2025-61945?
It affects 1 product.
Products include Radiometrics Vizair.
How do I fix CVE-2025-61945?
No fix has been published for CVE-2025-61945 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-61945 being exploited?
There is no known exploitation of CVE-2025-61945 in the wild and no public exploit code.
Other vulnerabilities in Radiometrics VizAir
Sources
Also known as GHSA-q4wg-4r43-jqjx.