Vulnerability · Published Jan 15, 2026 · Assigned by cisa-cg

CVE-2025-62193NOAA PMEL Live Access Server (LAS) PyFerret command injection

Critical 9.8

In plain English

A critical-severity OS command injection in Live Access Server (LAS) from National Oceanic and Atmospheric Administration (NOAA). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.3%top 29.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

Affected products (as reported)

Vendor	Product	Versions
National Oceanic and Atmospheric Administration (NOAA)	Live Access Server (LAS)	8

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

url product
url patch
url vdb-entry
url third-party-advisory, government-resource
url patch
url patch
url patch