Introduction
Remote attackers can exploit a critical flaw in Radiometrics VizAir to manipulate airport weather data, trigger false alerts, and potentially disrupt flight operations. The flaw, tracked as CVE-2025-54863, exposes REST API credentials in a misconfigured, publicly accessible file, which lets unauthorized parties control the meteorological systems those operations depend on.
About Radiometrics and VizAir: Radiometrics Corporation specializes in weather decision support systems for aviation, spaceports, and emergency management. Its VizAir product runs at airports worldwide and provides real-time wind shear detection, fog and icing alerts, and thunderstorm warnings. Airports rely on it for flight safety and operational continuity.
Technical Information
VizAir stores its REST API authentication key in a configuration file that anyone can reach over the network without authenticating. The file has no proper access controls or encryption, which violates basic credential management principles (CWE-522: Insufficiently Protected Credentials).
Attackers can find and retrieve the file with standard HTTP requests or automated directory enumeration. With the key in hand, they can make authenticated REST API calls that allow:
- Remote alteration of weather data and system configurations
- Extraction of sensitive meteorological data
- Automated attacks across multiple VizAir instances
- Floods of false alerts that cause denial of service
The root cause is plaintext storage of API credentials in a file that unauthenticated users can access. No public code snippets, patch details, or detection methods are available yet.
Affected Systems and Versions
- Product: Radiometrics VizAir
- Specific affected versions: Not disclosed in public sources
- Vulnerable configuration: REST API key stored in a publicly accessible configuration file
Vendor Security History
- No public record of prior similar vulnerabilities in Radiometrics VizAir
- No information on vendor patch response time or security maturity
- The vendor has worked with CISA to publish an advisory
