CVE-2025-61945: Critical Missing Auth in Radiometrics VizAir

CVE-2025-61945 is a critical (CVSS 10.0) missing authentication flaw in Radiometrics VizAir, an airport weather system. In versions before 08/2025, the admin panel can be reached without authentication, allowing changes to weather parameters such as wind shear alerts, inversion depth and CAPE values. CISA says Radiometrics updated all affected systems and no user action is needed.

What's affected

• Product: Radiometrics VizAir, a weather monitoring and display system used in airport operations.
• Weakness: CWE-306, missing authentication for a critical function.
• Affected: VizAir versions prior to 08/2025, per the CISA ICS advisory ICSA-25-308-04.
• Fixed: CISA reports that Radiometrics performed updates on all affected systems and resolved the vulnerabilities, and that no further action is needed on the user's end.
• CVSS 3.1: 10.0, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Network reachable, low complexity, no login, changed scope.
• Exploitation: CISA states that no known public exploitation specifically targeting these vulnerabilities had been reported to it at the time of the advisory. The CVE is not on the Known Exploited Vulnerabilities list.

The same CISA advisory covers more than one VizAir issue, including a separate CVE for an exposed REST API key. This article covers only CVE-2025-61945.

How to check if you're exposed

Because the vendor says it updated affected systems itself, your first step is confirmation, not installation. Ask Radiometrics or your integrator to confirm in writing that your VizAir instance is on a build dated 08/2025 or later.

Then check how the system is reachable. CISA's guidance for this advisory is about network exposure:

• Is the VizAir admin interface or its API reachable from the internet?
• Is it on a segmented network behind a firewall, apart from business networks?
• Is remote access done through a VPN or other controlled path?

If you can reach the admin pages from an untrusted network without being asked to log in, that is a finding to raise with the vendor immediately. Do not test by changing settings on a live system. Look at connection logs at the firewall for traffic from unexpected sources.

What to do now

1. Contact Radiometrics or your integrator and confirm your VizAir system is updated to the 08/2025 build or later.
2. Remove direct internet exposure for VizAir. Place it behind a firewall and isolate it from business networks, as CISA recommends.
3. Where remote access is needed, use a VPN, and keep the VPN itself updated.
4. Review firewall and access logs for unexpected sources reaching the admin interface or API.
5. Follow your organization incident procedure and report suspected malicious activity to CISA if you see it.
6. Record this system in your asset inventory so future advisories are matched to it. Operational technology is easy to miss.

Why it matters

CWE-306 means an important function can be used without proving who you are. For an internet-facing weather system at an airport, the consequence is not a data leak but wrong information: the advisory describes altered wind shear alerts, wrong runway assignments and misleading data for air traffic control and pilots.

That is why the score is a full 10.0, with a changed scope. The affected component's failure reaches safety processes beyond itself. Aviation has procedures that cross-check weather data, and the advisory does not claim any incident took place.

For defenders in operational technology, the lesson is familiar. Do not rely on obscurity or on the vendor alone. Keep these systems off the public internet, segment them, and keep an inventory of what runs where. Vendor-side fixes are welcome, but confirm them.

Quick check

Sources

• CISA ICS advisory ICSA-25-308-04 (fetched)
• CISA CSAF file for ICSA-25-308-04 (fetched)
• Safeguard Gold entry for CVE-2025-61945

Last reviewed: 18 October 2026.