CVE-2025-54863 is a critical flaw in Radiometrics VizAir, a weather monitoring product used at airports. The REST API key sits in a publicly accessible configuration file, so a remote party can read and change data and settings. CISA reports that Radiometrics updated all affected systems and no further customer action is needed.
What's affected
- Product: Radiometrics VizAir.
- Weakness: the system's REST API key is exposed through a publicly accessible configuration file.
- Sector: CISA lists Transportation Systems, deployed worldwide, with the vendor headquartered in the United States.
- Fixed version: CISA does not give a version number. It states that Radiometrics performed updates on all affected systems and resolved the issues.
That vendor-side update model is unusual. In many industrial products you patch yourself. Here, CISA's advisory says no action is needed on the user's end, so your job is mostly confirmation and exposure reduction. Ask Radiometrics for written confirmation that your instance is updated.
How to check if you're exposed
Start with the simplest question: is the management interface reachable from the internet? If it is, treat that as a finding regardless of this CVE.
- Ask your Radiometrics contact to confirm in writing that your VizAir instance has the update.
- From outside your network, confirm that the web interface and any configuration paths are not reachable without authentication.
- Review where the API key is stored and who has seen it. If there is any doubt that the old key was exposed, ask the vendor about rotating it.
- Check API and web server logs for requests from unfamiliar addresses, and for configuration changes nobody on your team made.
This is a hosted or vendor-managed style product rather than a library you install, so a dependency scan will not find it. It belongs in your OT asset inventory instead.
What to do now
- Contact Radiometrics and get confirmation that your instance has the fix, plus guidance on rotating the API key.
- Remove the device from direct internet exposure. CISA recommends keeping control system devices off the internet and behind firewalls.
- Place the system on a network segment separate from the business network.
- If remote access is required, use a VPN, keep it patched, and remember the VPN is only as secure as the devices connected to it.
- Review logs for unexpected configuration changes or bursts of alerts and report suspicious activity through your normal procedure and to CISA.
Why it matters
The weakness is insufficiently protected credentials. A secret that should live behind authentication was placed where anyone could fetch it. Once an API key is public, it is no longer a secret, and anything it authorizes is open to whoever finds it. The record warns about altered weather data, flooded alerts and exposure of meteorological data, in an aviation setting where wrong data could mislead planning.
CVSS 10.0 reflects network reach, no privileges, no user interaction and a changed scope. It is not on the CISA KEV list, and CISA's advisory says it knows of no public exploitation specifically targeting these vulnerabilities at the time of publication.
The weakness is classed as CWE-522 (Insufficiently Protected Credentials). Severity in the CVE record: critical, CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Quick check
Do I need to patch this myself?
CISA says Radiometrics updated all affected systems and no further action is needed on the user's end. Still get written confirmation for your instance and reduce network exposure.
Is this being exploited?
CISA's advisory says no known public exploitation specifically targeting these vulnerabilities had been reported at the time. The CVE is not on the KEV list.
Sources
- CISA ICS advisory ICSA-25-308-04
- CISA CSAF file for ICSA-25-308-04 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
