IBL Software Engineering Visual Weather Product Delivery Service deserialization

Summaryinfo

A vulnerability categorized as critical has been discovered in IBL Software Engineering Visual Weather, NAMIS, Aero Weather and Satellite Weather. Affected by this vulnerability is an unknown functionality of the component Product Delivery Service. Such manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2025-1077. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in IBL Software Engineering Visual Weather, NAMIS, Aero Weather and Satellite Weather (affected version unknown). Affected by this issue is an unknown functionality of the component Product Delivery Service. The manipulation with an unknown input leads to a deserialization vulnerability. Using CWE to declare the problem leads to CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The vulnerability is present in the Product Delivery Service (PDS) component in specific server configurations where the PDS pipeline utilizes the IPDS pipeline with Message Editor Output Filters enabled. A remote unauthenticated attacker can exploit this vulnerability to send unauthenticated requests to execute the IPDS pipeline with specially crafted Form Properties, enabling remote execution of arbitrary Python code. This vulnerability could lead to a full system compromise of the affected server, particularly if Visual Weather services are run under a privileged user account—contrary to the documented installation best practices.

The weakness was disclosed by Ianis Bernard as isec-2024-001. The advisory is shared for download at iblsoft.com. This vulnerability is handled as CVE-2025-1077 since 02/06/2025. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/07/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• IBL Software Engineering

Name

• Aero Weather
• NAMIS
• Satellite Weather
• Visual Weather

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion