External risk intelligence

Radiometrics VizAir REST API Key Exposure Allows Remote Weather Data Manipulation

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-54863

The vulnerability involves a REST API in a weather monitoring product, Radiometrics VizAir. Such systems are typically deployed as networked services to provide data to various operational stakeholders. The exposure of an API key in a publicly accessible configuration file facilitates remote interaction, making it a likely target for network-based access in common deployment environments.

Radiometrics Vizair

before 2025-08

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Radiometrics VizAir, a system used for aviation weather monitoring. The exposure of its REST API key through a publicly accessible configuration file allows remote attackers to alter weather data, manipulate system configurations, and potentially disrupt airport operations by causing denial-of-service conditions or providing incorrect data for flight planning.

System data can be remotely altered.
Confirms exposure and relevance for leadership.
Ensure operational integrity of weather systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by accessing a publicly exposed configuration file, which contains the system's REST API key. With this key, an attacker could remotely manipulate weather data, introduce false alerts, or extract sensitive meteorological information, potentially leading to disruptions in airport operations.

Entry condition: Public access to configuration files.
Trigger point: Accessing the exposed REST API key.
Resulting risk: Remote data manipulation and system disruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow attackers to remotely alter weather data and configurations, potentially compromising airport operations. Attackers could also flood the system with false alerts, causing denial-of-service and disrupting operations, which could lead to hazardous flight conditions.

System weather data and configurations are at risk.
Exposure occurs via a publicly accessible configuration file.
Disruption to airport operations and flight safety.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Radiometrics VizAir system's REST API key exposure likely impacts organizations managing aviation weather monitoring, such as airport authorities or aviation service providers. Initial actions should focus on discovering all instances of this technology, assessing their criticality and external reachability, and identifying the accountable system owner to coordinate remediation efforts.

Own the exposure discovery and risk assessment.
Verify system reachability and operational criticality.
Plan and coordinate vendor engagement and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Radiometrics VizAir?

Radiometrics VizAir is a specialized software solution designed for aviation weather monitoring. It processes meteorological data to assist with flight planning, takeoff, and landing safety. Airport authorities and aviation service providers rely on this system to provide accurate, real-time atmospheric conditions necessary for maintaining safe operational standards.

What does CVE-2025-54863 mean?

This CVE describes a security weakness categorized as CWE-522, which concerns the insufficient protection of credentials. In this specific case, the software stores a REST API key in a configuration file that is left publicly accessible. Because this key acts as a master pass for the system's interface, its exposure allows unauthorized users to bypass authentication and issue commands as if they were legitimate administrators.

How is this vulnerability triggered?

The vulnerability is triggered when an attacker identifies and accesses the specific configuration file where the API key is stored. It is important to note that the flaw does not require the attacker to compromise an internal user account or perform complex password cracking; if the configuration file is reachable over the network, the key can be retrieved directly.

Is my instance of Radiometrics VizAir at risk?

According to Halo Surface Signal, this vulnerability is highly relevant because VizAir is a networked service. If your installation is internet-facing or accessible through a network that allows unauthorized external reach, the risk is elevated. You should prioritize checking if the configuration file containing the API key can be accessed remotely from outside your protected environment.

How do I respond to this threat?

First, locate all instances of Radiometrics VizAir within your network to understand your footprint. Identify the system owners responsible for each instance and verify their connectivity to ensure they are not inadvertently exposed to the public internet. Coordinate with your team to review vendor guidance on securing these configuration files and plan for necessary software updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.