Description
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
National Oceanic and Atmospheric Administration (NOAA) Live Access Server (LAS)
Default version status: unknown
8affected8unaffected
References
- https://github.com/NOAA-PMEL/LAS/tree/main ↗
- https://github.com/NOAA-PMEL/LAS/blob/main/README.md ↗
- https://www.cve.org/CVERecord?id=CVE-2025-62193 ↗
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-015-01.json ↗
- https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29 ↗
- https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b ↗
- https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923 ↗