National Oceanic and Atmospheric Administration (NOAA) vulnerabilities

🔔 Create alert RSS

Published CVEs affecting National Oceanic and Atmospheric Administration (NOAA) products: 1 record(s), with severity, exploitation and fixes.

Live Access Server (LAS) 1

Exploited only (KEV) →

CVE-2025-62193 Critical · 9.8 CWE-78 Jan 15, 2026

NOAA PMEL Live Access Server (LAS) PyFerret command injection

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.