Introduction
Unauthorized changes to runway configurations and weather data can directly affect air traffic control and flight safety. CVE-2025-61956 is a critical gap in Radiometrics VizAir, a weather decision support system that airports worldwide rely on for operational meteorological intelligence.
About Radiometrics VizAir: Radiometrics Corporation specializes in atmospheric remote sensing and weather decision support. VizAir is deployed in major airports for wind shear detection, visibility forecasting, and real-time weather data integration. Air traffic controllers, pilots, and meteorological forecasters depend on its data, so its security is essential to aviation safety.
Technical information
CVE-2025-61956 comes from missing authentication controls on critical administrative and API functions in Radiometrics VizAir. It is classified as CWE-306 (Missing Authentication for Critical Function). Any remote user with network access to the VizAir system can perform privileged operations without authenticating.
Mechanism:
- Admin interfaces and API endpoints enforce no authentication.
- Attackers with network access can send crafted requests to these endpoints.
- Privileged actions include modifying active runway configurations and altering meteorological data.
- These changes can mislead air traffic controllers and pilots into inaccurate flight planning and potentially unsafe decisions.
Root Cause: The primary technical flaw is that neither the administrative layer nor the API layer of VizAir performs access control checks. No code snippets or exploit scripts are publicly available. The vulnerability is network-exploitable and requires no user interaction or privileges.
Affected systems and versions
- Product: Radiometrics VizAir (Weather Decision Support System)
- Specific affected versions: Not disclosed in public sources
- Vulnerable configurations: All deployments where admin or API interfaces are accessible over the network without additional authentication or network segmentation
Vendor security history
- No prior public vulnerabilities are documented for Radiometrics VizAir.
- Public sources have no information on previous patch response times or security maturity.
