TI-2025-38510 Aliases CVE-2025-62193 GHSA-4rx6-3q6g-vr7j

NOAA PMEL Live Access Server (LAS) PyFerret command injection

MEDIUM 45CWE-78Published 2026-01-15 · Updated 2026-01-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01302 70th percentileScored 2026-11-07

Fix Fixed Live Access Server (LAS) (National Oceanic and Atmospheric Administration (NOAA)): 8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
National Oceanic and Atmospheric Administration (NOAA)	Live Access Server (LAS)	8	8	Patch available	CNA

Live Access Server (LAS) VendorNational Oceanic and Atmospheric Administration (NOAA) Affected 8 Fixed in 8 Patch available CNA

Remediation

Fix · CNA Live Access Server (LAS) (National Oceanic and Atmospheric Administration (NOAA)) Fixed in 8

Timeline

2026-10-02 Threatist record created from CVE-2025-62193
2026-10-03 Alias added: GHSA-4rx6-3q6g-vr7j

References

Patch 4

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences