CVE-2025-54863: Radiometrics Vizair Disclosure Flaw

CVE-2025-54863 Overview

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This critical vulnerability allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could potentially compromise airport operations. Additionally, attackers could flood the system with false alerts, leading to a denial-of-service condition and significant disruption to airport operations. Unauthorized remote control over aviation weather monitoring and data manipulation could result in incorrect flight planning and hazardous takeoff and landing conditions.

Critical Impact

Attackers can gain unauthorized access to aviation weather monitoring systems, manipulate meteorological data, and potentially create dangerous flight conditions affecting airport operations and aviation safety.

Affected Products

• Radiometrics VizAir (all versions)

Discovery Timeline

• November 4, 2025 - CVE-2025-54863 published to NVD
• November 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-54863

Vulnerability Analysis

This vulnerability stems from CWE-522 (Insufficiently Protected Credentials) where the system's REST API key is stored in a configuration file that is publicly accessible. Aviation weather monitoring systems like VizAir are critical infrastructure components that airports rely on for accurate meteorological data to ensure safe flight operations.

The exposure of the API key through a publicly accessible configuration file represents a severe security oversight in the system's design. Once an attacker obtains this key, they gain full programmatic access to the system's REST API, enabling them to perform any authorized operation without legitimate credentials. The network-accessible nature of this vulnerability means it can be exploited remotely without any user interaction or prior authentication.

The potential impact extends beyond simple data theft—attackers could manipulate weather readings to show false conditions, inject misleading alerts, or suppress genuine warnings. In aviation contexts, such manipulation could lead to dangerous decisions regarding takeoffs, landings, and flight routing.

Root Cause

The root cause of this vulnerability is the storage of sensitive API credentials in a publicly accessible configuration file without proper access controls or encryption. This represents a fundamental failure in secure credential management practices, where sensitive authentication material should never be stored in locations accessible to unauthorized parties. The configuration file likely lacks appropriate file system permissions or is served through a web interface without authentication requirements.

Attack Vector

The attack vector is network-based, requiring no authentication, no user interaction, and low complexity to exploit. An attacker can access the publicly exposed configuration file through standard HTTP requests to retrieve the API key. Once obtained, this key provides full API access, allowing the attacker to:

1. Query and extract sensitive meteorological data and system configurations
2. Modify weather readings and inject false data into the system
3. Create automated attacks across multiple VizAir instances using the same methodology
4. Flood the system with false alerts, causing denial-of-service conditions
5. Potentially disrupt critical airport operations that depend on accurate weather monitoring

The attacker can perform reconnaissance to identify exposed VizAir instances, retrieve the configuration file containing the API key, and then leverage the REST API for malicious purposes—all without requiring any special privileges or complex exploitation techniques.

Detection Methods for CVE-2025-54863

Indicators of Compromise

• Unexpected or unauthorized access to configuration files, particularly those containing API credentials
• Unusual API request patterns or volumes from unknown IP addresses
• Unexplained changes to weather data, system configurations, or alert thresholds
• Authentication logs showing API key usage from external or unauthorized sources
• Sudden increase in weather alerts or data submission requests

Detection Strategies

• Monitor web server access logs for requests targeting configuration files (e.g., config.json, settings.ini, .env files)
• Implement API request monitoring to detect anomalous usage patterns or requests from unusual geographic locations
• Deploy file integrity monitoring on configuration files containing sensitive credentials
• Configure alerts for any modifications to weather data or system settings outside of normal operational procedures

Monitoring Recommendations

• Enable comprehensive logging for all REST API endpoints and review logs regularly for suspicious activity
• Implement network-level monitoring to detect reconnaissance attempts against VizAir instances
• Set up automated alerts for configuration file access attempts from external IP addresses
• Monitor for data integrity issues by comparing reported weather data against known meteorological baselines

How to Mitigate CVE-2025-54863

Immediate Actions Required

• Restrict access to configuration files containing API keys using proper file system permissions and web server access controls
• Rotate all existing API keys immediately, as they should be considered compromised if the configuration file was publicly accessible
• Implement network segmentation to limit access to VizAir systems from untrusted networks
• Review access logs to identify any potential unauthorized access that may have already occurred
• Consider taking affected systems offline until proper security controls can be implemented

Patch Information

Refer to the CISA ICS Advisory ICSA-25-308-04 for official vendor guidance and patch information from Radiometrics. Organizations should contact Radiometrics directly for specific remediation instructions and updated software versions that address this vulnerability. Additional technical details are available in the GitHub CSAF JSON File.

Workarounds

• Move API credentials to secure storage mechanisms such as environment variables, secrets management systems, or encrypted configuration stores
• Implement IP allowlisting to restrict API access to known, trusted network addresses
• Deploy a reverse proxy or API gateway to add authentication and rate limiting layers in front of the VizAir REST API
• Enable network-level access controls (firewalls, VPNs) to prevent direct external access to VizAir systems
• Implement API key rotation policies and monitoring to detect and respond to credential compromise quickly

# Example: Restrict configuration file permissions (Linux)
chmod 600 /path/to/vizair/config.json
chown vizair_service:vizair_group /path/to/vizair/config.json

# Example: Implement IP allowlisting via iptables
iptables -A INPUT -p tcp --dport 443 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP