CVE-2025-62193

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
National Oceanic and Atmospheric Administration (NOAA)Live Access Server (LAS)8

References

Timeline

Published
Jan 15, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-621985.4An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to verCVE-2025-621997.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-62207.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the CVE-2025-622007.8Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622017.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622027.1Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2025-622037.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-622048.0Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2025-622057.8Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.CVE-2025-622066.5Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to discloCVE-2025-622079.8Azure Monitor Elevation of Privilege VulnerabilityCVE-2025-622085.5Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.
CVE-2025-62193: Critical severity, CVSS 9.8 | Vulnix