PT-2026-3061 · Noaa Pmel · Live Access Server

Published 2026-01-15 · Updated 2026-01-15 · CVE-2025-62193

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NOAA PMEL Live Access Server (LAS) (affected versions not specified)

Description Sites running NOAA PMEL Live Access Server (LAS) are susceptible to remote code execution through specially crafted requests containing PyFerret expressions. An unauthenticated, remote attacker can leverage a SPAWN command to execute arbitrary operating system commands. The issue involves a component named gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java, which was updated on 2025-09-24.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-62193

Affected Products

Live Access Server

References · 14

• https://github.com/NOAA-PMEL/LAS/compare/b4b7306..de5f923 · Patch
• https://github.com/NOAA-PMEL/LAS/commit/e69afb1898ae7e69f3e047513fc1e5570373912b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-62193 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-62193 · Security Note
• https://github.com/NOAA-PMEL/LAS/commit/de5f9237bfd4ac5085bcc49a6e30bbc9507ddb29 · Patch
• https://github.com/NOAA-PMEL/LAS/blob/main/README.md · Patch
• https://osv.dev/vulnerability/CVE-2025-62193 · Vendor Advisory
• https://twitter.com/TheHackerWire/status/2011856861151313967 · Twitter Post
• https://twitter.com/CVEnew/status/2011926078550654988 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011917936550621470 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-26-015-01.json · Note
• https://twitter.com/0dayPublishing/status/2011844871791755486 · Twitter Post
• https://github.com/NOAA-PMEL/LAS/tree/main · Note
• https://twitter.com/CveFindCom/status/2011855784141869056 · Twitter Post