Unauthenticated CPDLC flaws let rogues inject clearances
Five unauthenticated-protocol flaws in ATN-B1 CPDLC air traffic messaging allow rogue radio stations to inject or disrupt pilot/controller communications, with no fix available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA published an ICS advisory detailing five vulnerabilities in the Controller-Pilot Data Link Communications (CPDLC) protocol as implemented over ATN-B1, the datalink used for air traffic control clearances worldwide. The root cause is architectural: CPDLC relies on clear-text, unauthenticated VHF radio links, which permits an attacker with radio equipment to inject spoofed clearance or emergency messages, forcibly terminate sessions (forcing reversion to voice comms), and disconnect multiple aircraft simultaneously via broadcast control frames. None of the flaws create an unsafe aircraft condition on their own, but they can degrade operational safety margins by increasing controller/pilot workload, delaying safety-critical instructions, and reducing situational awareness.
The five CVEs (CVE-2025-71409 through CVE-2025-71413) cover missing authentication for VHF data link messages, malformed/unnumbered disconnect frames terminating sessions, broadcast frames causing mass disconnects, injection of false emergency/status messages, and malformed X.25-layer frames causing repeated resets. All require radio-frequency proximity and are rated high attack complexity; CISA states the issues have been demonstrated in a lab environment by researcher Martin Strohmeier (Armasuisse) and that no public exploitation has been observed in the wild. No patches or mitigations currently exist, and organizations are advised only to report suspicious activity through established channels.
Given the lack of active exploitation, the lab-only demonstration, high attack complexity, and the advisory's own assessment that these do not create an unsafe aircraft condition, this is a notable but not urgent protocol-design disclosure affecting global aviation transportation infrastructure. It underscores a long-standing legacy weakness in CPDLC/ATN-B1 that will require industry-wide protocol authentication improvements rather than a simple patch.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs