CVE-2025-62193

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-62193
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/NOAA-PMEL/LAS/blob/main/README.md
https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29
https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b
https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923
https://github.com/NOAA-PMEL/LAS/tree/main
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-015-01.json
https://www.cve.org/CVERecord?id=CVE-2025-62193
Configurations

No configuration.

History

15 Apr 2026, 00:35

Type Values Removed Values Added
Summary
  • (es) Los sitios que ejecutan NOAA PMEL Live Access Server (LAS) son vulnerables a ejecución remota de código a través de solicitudes especialmente diseñadas que incluyen expresiones PyFerret. Al aprovechar un comando SPAWN, un atacante remoto no autenticado puede ejecutar comandos OS arbitrarios. Corregido en una versión de 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' del 24-09-2025.

15 Jan 2026, 19:16

Type Values Removed Values Added
Summary (en) Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, unauthenticated attackers can execute arbitrary OS commands. (en) Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.
References
  • () https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29 -
  • () https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b -
  • () https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923 -

15 Jan 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-15 17:16

Updated : 2026-04-15 00:35

NVD link : CVE-2025-62193

Mitre link : CVE-2025-62193

CVE.ORG link : CVE-2025-62193

JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')