CVE-2025-54863

Critical

Published: 04 November 2025

Published

04 November 2025

Modified

12 November 2025

KEV Added

—

Patch

—

CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0011 29.7th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-54863 is a critical-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Radiometrics Vizair. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-22 (Publicly Accessible Content) and CM-6 (Configuration Settings).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 3 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-22 Publicly Accessible Content good match

prevent

Directly requires reviewing and restricting publicly accessible content to prevent exposure of sensitive information like the REST API key in configuration files.

IA-5 Authenticator Management good match

prevent

Mandates protection of authenticators, such as API keys, from unauthorized disclosure, directly addressing the exposed credential vulnerability.

CM-6 Configuration Settings good match

prevent

Requires securing configuration settings to prevent exposure of sensitive credentials like API keys in publicly accessible files.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

T1499.003 Application Exhaustion Flood Impact

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.

attack.mitre.org →

Why these techniques?

Vulnerabilities enable exploitation of public-facing REST API and admin panel lacking authentication (T1190), exposure of API key in publicly accessible config file (T1552.001), remote alteration of stored weather data and configurations (T1565.001), and DoS via flooding API with false alerts (T1499.003).

NVD Description

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could…

potentially compromise airport operations. Additionally, attackers could flood the system with false alerts, leading to a denial-of-service condition and significant disruption to airport operations. Unauthorized remote control over aviation weather monitoring and data manipulation could result in incorrect flight planning and hazardous takeoff and landing conditions.

Deeper analysisAI

CVE-2025-54863 is a critical vulnerability in Radiometrics VizAir, where the system's REST API key is exposed through a publicly accessible configuration file. This issue, mapped to CWE-522 (Insufficiently Protected Credentials), carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting its potential for high-impact network-based exploitation without requiring authentication or user interaction.

Attackers with network access can remotely leverage the exposed API key to alter weather data and system configurations, extract sensitive meteorological information, and automate attacks against multiple VizAir instances. They could also flood the system with false alerts, resulting in denial-of-service conditions that disrupt airport operations. Such unauthorized control over aviation weather monitoring risks incorrect flight planning and hazardous takeoff or landing scenarios.

The CISA advisory ICSA-25-308-04 provides details on mitigation strategies; refer to https://www.cisa.gov/news-events/ics-advisories/icsa-25-308-04 and the associated CSAF file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-308-04.json for patches, workarounds, and further guidance.