National Oceanic And Atmospheric Administration Live Access Server vulnerabilities

CVE-2025-62193 [CRITICAL] CWE-78 CVE-2025-62193: Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via special Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of 'gov.noaa.pmel.tmap.las.filter.RequestInputFilter.java' from 2025-09-24.