CISA Warns: Critical VizAir Flaws (CVSS 10.0) Expose Airport Weather Systems to Unauthenticated Manipulation

CISA has issued a critical advisory detailing three vulnerabilities in the Radiometrics VizAir aviation weather monitoring system, warning that exploitation could allow attackers to manipulate meteorological data and runway configurations, potentially leading to hazardous flight conditions.

According to the advisory, successful exploitation could enable attackers to manipulate critical weather parameters and runway settings, mislead air traffic control and pilots, extract sensitive meteorological data, and cause significant disruption to airport operations. The flaws are tracked as CVE-2025-61945, CVE-2025-54863, and CVE-2025-61956, each with a CVSS v3.1 base score of 10.0.

Radiometrics VizAir (versions prior to August 2025) provides real-time data used in flight planning and runway management, and the first vulnerability stems from unauthenticated access to the VizAir admin panel, while the second involves exposed REST API keys and protected configuration files, and the third mirrors the first at API level access.

Radiometrics has released updates addressing all three issues, and users are urged to verify they are on version 08/2025 or later and ensure systems are isolated from public networks with strong authentication.