CVE-2025-62193criticalCWE-78

NOAA PMEL Live Access Server (LAS) PyFerret command injection

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 1.3%

probabilidade de exploração

1.3%top 30% das CVEs

exploração observada

nãonenhuma fonte reporta

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

National Oceanic and Atmospheric Administration (NOAA) · Live Access Server (LAS)

Referências

https://github.com/NOAA-PMEL/LAS/blob/main/README.md https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29 https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923 https://github.com/NOAA-PMEL/LAS/tree/main https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-015-01.json https://www.cve.org/CVERecord?id=CVE-2025-62193