CVE-2025-61956: Radiometrics VizAir Auth Bypass Flaw

CVE-2025-61956 Overview

CVE-2025-61956 is a critical authentication bypass vulnerability affecting Radiometrics VizAir, an industrial control system (ICS) software used in aviation meteorological monitoring. The vulnerability stems from missing authentication mechanisms for critical functions, including administrative access and API requests. This flaw allows unauthenticated attackers to modify system configurations remotely, potentially manipulating active runway settings and misleading air traffic control (ATC) personnel and pilots.

The impact of this vulnerability extends beyond typical IT security concerns into the realm of aviation safety. Attackers exploiting this flaw could manipulate meteorological data used by forecasters and ATC, resulting in inaccurate flight planning and potentially dangerous operational decisions.

Critical Impact

Unauthenticated attackers can modify runway configurations and manipulate meteorological data, potentially misleading air traffic control and pilots with catastrophic safety implications.

Affected Products

• Radiometrics VizAir (all versions)

Discovery Timeline

• 2025-11-04 - CVE CVE-2025-61956 published to NVD
• 2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-61956

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function), which represents a fundamental security design flaw where the application fails to perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

In the case of Radiometrics VizAir, the system exposes administrative interfaces and API endpoints without requiring any form of authentication. This design oversight allows any network-accessible attacker to interact with sensitive system functions as if they were an authorized administrator. The vulnerability is particularly severe given the safety-critical nature of aviation meteorological systems.

The attack surface is network-accessible, requiring no user interaction or special privileges, which makes exploitation trivially achievable for any attacker with network access to the vulnerable system.

Root Cause

The root cause of CVE-2025-61956 is the complete absence of authentication controls on critical system functions. The VizAir application was designed or deployed without implementing authentication mechanisms for administrative access points and API interfaces. This represents a fundamental security architecture failure where security controls were either not implemented during development or were inadvertently bypassed during deployment.

Attack Vector

The attack vector for this vulnerability is network-based, allowing remote exploitation. An attacker with network access to the VizAir system can directly access administrative functions and API endpoints without providing credentials. The attack requires no complexity, prior authentication, or user interaction.

Potential attack scenarios include:

1. Runway Configuration Manipulation: An attacker could modify active runway settings, potentially directing aircraft to incorrect runways or providing false approach information.

2. Meteorological Data Tampering: Manipulating weather data readings could cause pilots and ATC to make decisions based on false wind speed, visibility, or precipitation information.

3. System Disruption: Unauthorized configuration changes could render the monitoring system non-functional during critical operations.

The network-accessible nature of this vulnerability means that if the VizAir system is exposed to untrusted networks or the internet, the attack surface becomes significantly broader. For technical details, refer to the CISA ICS Advisory.

Detection Methods for CVE-2025-61956

Indicators of Compromise

• Unexpected configuration changes to runway settings or meteorological parameters without corresponding authenticated sessions
• API requests to administrative endpoints from unauthorized IP addresses or without valid session tokens
• Log entries showing administrative actions during off-hours or from unusual network locations
• Discrepancies between reported meteorological data and actual environmental conditions

Detection Strategies

• Monitor network traffic to VizAir systems for unauthorized access attempts to administrative interfaces and API endpoints
• Implement network-level access controls and log all connection attempts to VizAir systems
• Deploy intrusion detection systems (IDS) with rules to detect unauthenticated administrative API calls
• Establish baseline configuration states and alert on any modifications to critical system settings

Monitoring Recommendations

• Enable comprehensive logging for all administrative actions and API requests on VizAir systems
• Implement real-time alerting for configuration changes to critical runway and meteorological settings
• Conduct regular configuration audits to detect unauthorized modifications
• Monitor for network scanning activity targeting VizAir system ports and services

How to Mitigate CVE-2025-61956

Immediate Actions Required

• Isolate Radiometrics VizAir systems from untrusted networks immediately
• Implement network segmentation to restrict access to VizAir systems to authorized personnel only
• Deploy a web application firewall (WAF) or reverse proxy to enforce authentication before requests reach the VizAir system
• Review all current VizAir configurations for unauthorized modifications and restore from known-good backups if tampering is suspected

Patch Information

Organizations should consult the CISA ICS Advisory ICSA-25-308-04 for the latest vendor guidance and patch availability. The CSAF advisory file contains additional technical details about the vulnerability and remediation steps.

Contact Radiometrics directly for information about firmware updates or patches that address this authentication vulnerability.

Workarounds

• Implement network access controls (firewalls, VLANs) to limit VizAir system access to trusted IP addresses only
• Deploy a VPN requirement for all remote access to VizAir systems
• Add an authentication proxy layer in front of VizAir administrative interfaces and APIs
• Disable unnecessary network services and close unused ports on VizAir systems

# Example network segmentation configuration (iptables)
# Restrict access to VizAir system to authorized management subnet only
iptables -A INPUT -s 10.10.50.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 10.10.50.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP