CVE Intelligence

National Oceanic and Atmospheric Administration (NOAA) Live Access Server (LAS) vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting National Oceanic and Atmospheric Administration (NOAA) Live Access Server (LAS): 1 record(s), with affected versions and fixes.

CVE-2025-62193 Critical · 9.8 CWE-78 Jan 15, 2026
NOAA PMEL Live Access Server (LAS) PyFerret command injection
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.