CVE-2025-62193criticalCWE-78

NOAA PMEL Live Access Server (LAS) PyFerret command injection

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 1.3%

exploitation probability

1.3%top 31% of all CVEs

observed exploitation

nono source reports it

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

National Oceanic and Atmospheric Administration (NOAA) · Live Access Server (LAS)

References

https://github.com/NOAA-PMEL/LAS/blob/main/README.md https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29 https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923 https://github.com/NOAA-PMEL/LAS/tree/main https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-015-01.json https://www.cve.org/CVERecord?id=CVE-2025-62193