Introduction
Unauthorized changes to runway configurations and weather data can directly impact air traffic control and flight safety. CVE-2025-61956 exposes a critical gap in Radiometrics VizAir, a weather decision support system relied upon by airports worldwide for operational meteorological intelligence.
About Radiometrics VizAir: Radiometrics Corporation specializes in atmospheric remote sensing and weather decision support. VizAir is deployed in major airports for wind shear detection, visibility forecasting, and real-time weather data integration. Its data is integral to air traffic control, pilots, and meteorological forecasters, making its security essential for aviation safety.
Technical Information
CVE-2025-61956 is a direct result of missing authentication controls on critical administrative and API functions in Radiometrics VizAir. Classified under CWE-306 (Missing Authentication for Critical Function), the vulnerability allows any remote user with network access to the VizAir system to perform privileged operations without authentication.
Mechanism:
- No authentication is enforced on admin interfaces and API endpoints.
- Attackers with network access can send crafted requests to these endpoints.
- Privileged actions include modifying active runway configurations and altering meteorological data.
- Such changes can mislead air traffic controllers and pilots, resulting in inaccurate flight planning and potentially unsafe decisions.
Root Cause: The absence of access control checks in both the administrative and API layers of VizAir is the primary technical flaw. There are no public code snippets or exploit scripts available. The vulnerability is network-exploitable and requires no user interaction or privileges.
Affected Systems and Versions
- Product: Radiometrics VizAir (Weather Decision Support System)
- Specific affected versions: Not disclosed in public sources
- Vulnerable configurations: All deployments where admin or API interfaces are accessible over the network without additional authentication or network segmentation
Vendor Security History
- No prior public vulnerabilities are documented for Radiometrics VizAir.
- No information on previous patch response times or security maturity is available in public sources.
