CVE-2025-1077

Summary

A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The vulnerability is present in the Product Delivery Service (PDS) component in specific server configurations where the PDS pipeline utilizes the IPDS pipeline with Message Editor Output Filters enabled.

A remote unauthenticated

attacker can exploit this vulnerability to send unauthenticated requests to execute the IPDS pipeline with specially crafted Form Properties, enabling remote execution of arbitrary Python code. This vulnerability could lead to a full system compromise of the affected server, particularly if Visual Weather services are run under a privileged user account—contrary to the documented installation best practices.

Upgrade to the patched versions 7.3.10 (or higher), 8.6.0 (or higher).

Affected Software

VendorProductVersion RangeStatus
IBL Software EngineeringVisual Weather8.2.5affected
IBL Software EngineeringVisual Weather7.3.9affected
IBL Software EngineeringVisual Weather7.3.6 (Enterprise Build)affected
IBL Software EngineeringVisual Weather8.5.2 (Enterprise Build)affected
IBL Software EngineeringNAMIS8.2.5affected
IBL Software EngineeringNAMIS7.3.9affected
IBL Software EngineeringNAMIS7.3.6 (Enterprise Build)affected
IBL Software EngineeringNAMIS8.5.2 (Enterprise Build)affected
IBL Software EngineeringAero Weather8.2.5affected
IBL Software EngineeringAero Weather7.3.9affected
IBL Software EngineeringAero Weather7.3.6 (Enterprise Build)affected
IBL Software EngineeringAero Weather8.5.2 (Enterprise Build)affected
IBL Software EngineeringSatellite Weather8.2.5affected
IBL Software EngineeringSatellite Weather7.3.9affected
IBL Software EngineeringSatellite Weather7.3.6 (Enterprise Build)affected
IBL Software EngineeringSatellite Weather8.5.2 (Enterprise Build)affected

Weaknesses

  • CWE-502: CWE-502 Deserialization of Untrusted Data
  • CWE-20: CWE-20 Improper Input Validation

Workarounds

In order to mitigate the vulnerability: - Disable PDS pipelines utilizing IPDS pipelines in server configurations. - Enforce installation best practices by ensuring Visual Weather services are not run under a privileged user account. - Restrict network access to the PDS pipeline endpoint to trusted IP ranges only.

It is also recommended to contact IBL Support Team for more detailed security and server hardening guidelines.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References