NOAA-PMEL/LAS

NOAA-PMEL/LAS

GitHubGitHub
GitHubgithub.com
ferret.pmel.noaa.govferret.pmel.noaa.gov
Releases19
Frequency3 months 3 weeks
Last Release
Live Access Server
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-62193↗
9.8 CRITICAL—

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.