Loading story…
Radiometrics VizAir, a system used for aviation weather monitoring and runway management, is affected by multiple critical vulnerabilities that allow remote attackers to bypass authentication and access sensitive functions. The flaws include missing authentication for critical functions (CVE-2025-61945, CVE-2025-61956) and insufficiently protected credentials (CVE-2025-54863), enabling attackers to modify weather parameters, manipulate runway settings, and extract sensitive meteorological data. Exploitation of these vulnerabilities could mislead air traffic control and pilots, disable vital alerts, and result in hazardous flight conditions, including the risk of mid-air conflicts or runway incursions.
Attackers can exploit these issues by accessing the admin panel or exposed API keys without authentication, allowing them to alter configurations, automate attacks across multiple VizAir instances, and flood the system with false alerts, potentially causing denial-of-service and significant disruption to airport operations. All versions of Radiometrics VizAir prior to August 2025 are affected, and the vulnerabilities have been rated with a CVSS score of 10.0, indicating maximum severity and urgent need for remediation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Public vulnerability records were published for CVE-2025-61956 and CVE-2025-61945, both described as missing authentication for a critical function, and CVE-2025-54863, described as insufficiently protected credentials in Radiometrics VizAir. These listings indicate technical classification of the disclosed VizAir flaws.
CISA published ICS advisory ICSA-25-308-04 covering security issues affecting Radiometrics VizAir. The advisory marks the public disclosure of the product's reported vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A set of critical vulnerabilities has been identified in the METZ CONNECT EWIO2 series, including models EWIO2-M, EWIO2-M-BM, and EWIO2-BM running firmware versions below 2.2.0. The most severe issue is an authentication bypass (CVE-2025-41733/41734) that allows unauthenticated attackers with network access to gain administrative control over the device. Exploitation enables attackers to change configurations, manipulate data, disrupt services, and potentially render the device inoperable. Additional vulnerabilities include improper control of filename for include/require statements, unrestricted upload of dangerous file types, path traversal, and improper access control, collectively enabling remote code execution and full device compromise. CISA has issued an ICS advisory (ICSA-25-322-05) highlighting the remote exploitability and low attack complexity of these flaws, assigning a CVSS v4 base score of 9.3. The vulnerabilities stem from the commissioning wizard failing to validate device initialization, allowing attackers to set root credentials via crafted POST requests. Organizations using affected METZ CONNECT EWIO2 devices are urged to review technical details and apply mitigations to prevent unauthorized access and maintain device integrity and availability.
Jun 29, 2026
CISA published ICS advisories warning of **critical “missing authentication for critical function”** weaknesses (CWE-306) that expose device management/control interfaces to unauthenticated access. **Synectix LAN 232 TRIO** (3-port serial-to-Ethernet adapter) is affected in **all versions** under **CVE-2026-1633** with **CVSS 3.1 10.0**, enabling unauthenticated attackers to **modify critical device settings** or **factory reset** the device. **Avation Light Engine Pro** is also affected in **all versions** under **CVE-2026-1341** with **CVSS 3.1 9.8**, allowing an attacker to **take full control** of the device due to an exposed configuration/control interface without authentication. Separate reporting highlighted a similar CISA alert for **KiloView Encoder Series** devices, tracked as **CVE-2026-1453** with **CVSS 9.8**, where missing authentication allows unauthenticated users to perform administrative actions such as **creating or deleting administrator accounts**, potentially granting full administrative control and enabling disruption or hijacking of broadcast/streaming workflows. The KiloView issue was described as affecting multiple Encoder Series models and specific firmware/hardware combinations (e.g., E1/E1-s/E2 with listed firmware versions), reinforcing the broader risk of internet- or enterprise-exposed device management planes lacking access control.
Jun 29, 2026
Galaxy Software Services' **Vitals ESP** is affected by two high-severity vulnerabilities that could let remote attackers access sensitive functions and elevate privileges. **CVE-2026-4640** is a **missing authentication** flaw (`CWE-306`) that allows **unauthenticated** attackers to remotely execute certain functions and obtain sensitive information, with CVSS vectors indicating network-based exploitation, low attack complexity, and no required user interaction or privileges. A second issue, **CVE-2026-4639**, is an **incorrect authorization** vulnerability (`CWE-863`) that allows **authenticated** remote attackers to perform administrative functions and escalate privileges. TWCERT/CC published references for both flaws in English and Chinese, and the scoring for each indicates material risk to confidentiality, integrity, and availability in deployments of Vitals ESP.
Jun 29, 2026