8 minhigh
CPDLC over ATN-B1 Vulnerabilities (CVE-2025-71409, CVE-2025-71410, CVE-2025-71411 +2 more)
CISA published an ICS advisory detailing five vulnerabilities in the CPDLC over ATN-B1 aviation data link protocol. The protocol relies on legacy clear-text, unauthenticated VHF radio frequency links, enabling rogue ground stations to inject false CPDLC messages, terminate sessions, and trigger denial-of-service conditions. No patches or mitigations are available. The vulnerabilities require high attack complexity and specific conditions, making exploitation unlikely outside a lab environment, but successful exploitation could degrade operational safety margins in air traffic management.
Conf:high
Showing defanged values
- cveCVE-2025-71409Missing authentication for VHF Data Link messages allows rogue ground stations to inject CPDLC messages, leading to misleading clearances and pilot confusion.
- cveCVE-2025-71410Unnumbered Disconnect and malformed AVLC frames can terminate CPDLC sessions, forcing reversion to voice communication and increasing controller workload.
- cveCVE-2025-71411Broadcast control frames can disconnect multiple aircraft simultaneously, causing delayed clearances and air traffic controller overload.
- cveCVE-2025-71412Injection of false emergency or status messages over CPDLC may cause misallocation of resources and improper response actions by crews, controllers, and ground operations.
- cveCVE-2025-71413Malformed or out-of-sequence frames at the AVLC X.25 layers cause repeated resets, resulting in increased workload and reduced situational awareness.
Detection / Hunteropenrouter
What Happened
A government cybersecurity agency published a warning about security flaws in a communication system used between aircraft and air traffic controllers. The system, called CPDLC, sends text-based instructions over radio waves but does not authenticate or encrypt those messages. This means someone with the right radio equipment could potentially send fake instructions to pilots, cut off communication sessions, or disrupt multiple aircraft at once. No fixes are currently available. The flaws are difficult to exploit and require specialized conditions, and no real-world attacks have been reported. Organizations in the aviation sector should review their internal procedures, monitor for suspicious activity, and report any findings to the cybersecurity agency.
Key Takeaways
- Five vulnerabilities in the CPDLC over ATN-B1 protocol allow unauthorized message injection, denial-of-service, and forced session resets over unauthenticated VHF radio frequency links.
- No remediations or mitigations are currently available for any of the five CVEs (CVE-2025-71409 through CVE-2025-71413).
- Attack complexity is high and exploitation requires very specific conditions; no public exploitation has been reported.
- CVE-2025-71409 and CVE-2025-71412 are rated HIGH (CVSS 7.1) and enable injection of false clearances or emergency messages that could mislead flight crews and controllers.
- Affected product is Advisory Circular 90-117 Data Link Communications ATN-B1 CPDLC vers:all/*, deployed worldwide in the Transportation Systems sector.
Affected Systems
- Advisory Circular 90-117 Data Link Communications ATN-B1 CPDLC (vers:all/*)
- Aviation VHF Data Link ground stations and aircraft CPDLC implementations conforming to ATN-B1
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-71409 | ATN-B1 CPDLC (Advisory Circular 90-117 Data Link Communications) | High | Missing authentication for VHF Data Link messages allows rogue ground stations to inject CPDLC messages, leading to misleading clearances and pilot confusion. |
| CVE-2025-71410 | ATN-B1 CPDLC (Advisory Circular 90-117 Data Link Communications) | Medium | Unnumbered Disconnect and malformed AVLC frames can terminate CPDLC sessions, forcing reversion to voice communication and increasing controller workload. |
| CVE-2025-71411 | ATN-B1 CPDLC (Advisory Circular 90-117 Data Link Communications) | Medium | Broadcast control frames can disconnect multiple aircraft simultaneously, causing delayed clearances and air traffic controller overload. |
| CVE-2025-71412 | ATN-B1 CPDLC (Advisory Circular 90-117 Data Link Communications) | High | Injection of false emergency or status messages over CPDLC may cause misallocation of resources and improper response actions by crews, controllers, and ground operations. |
| CVE-2025-71413 | ATN-B1 CPDLC (Advisory Circular 90-117 Data Link Communications) | Medium | Malformed or out-of-sequence frames at the AVLC X.25 layers cause repeated resets, resulting in increased workload and reduced situational awareness. |
Attack Chain
- Reconnaissance: Attacker identifies aircraft or ground stations actively using CPDLC over ATN-B1 on VHF data link frequencies.
- Message Injection (CVE-2025-71409, CVE-2025-71412): Rogue ground station transmits unauthenticated CPDLC messages containing false clearances, emergency alerts, or status messages over radio frequency.
- Denial of Service (CVE-2025-71410, CVE-2025-71411): Attacker sends Unnumbered Disconnect frames or broadcast control frames to terminate CPDLC sessions for one or multiple aircraft simultaneously.
- Session Degradation (CVE-2025-71413): Malformed or out-of-sequence AVLC X.25 frames trigger repeated protocol resets, degrading situational awareness and increasing workload.
- Impact: Flight crews and controllers experience misleading information, delayed clearances, forced reversion to voice communication, and increased operational workload.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the advisory. The article recommends following established internal procedures and reporting suspected malicious activity to CISA.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | These vulnerabilities target aviation radio frequency protocols (VHF Data Link, AVLC, X.25) and CPDLC application-layer messages. EDR agents on standard IT endpoints would not have visibility into RF-layer or avionics data link traffic. |
| Network Visibility | Low | Standard network monitoring tools (IDS/IPS, firewalls) operate on IP-based networks and would not capture VHF radio frequency communications. Specialized aviation data link monitoring infrastructure would be required, which is outside typical SOC telemetry. |
| Detection Difficulty | Very Hard | Detection requires specialized RF monitoring equipment and protocol-level analysis of VHF Data Link, AVLC, and CPDLC frames. Most organizations do not have this telemetry in their security operations centers. Distinguishing malicious injected messages from legitimate traffic is non-trivial without authentication mechanisms in the protocol. |
Required Log Sources
- Aviation data link ground station logs
- CPDLC message logs with session metadata
- AVLC frame-level capture and analysis
- Air traffic controller workstation operational logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for CPDLC messages received from ground station identifiers that are not in the authorized ground station list, which could indicate rogue station injection (CVE-2025-71409). | CPDLC message logs with originating ground station identifiers and authentication status | Initial Access / Execution | Medium — legitimate ground station identifier changes or misconfigurations could trigger alerts. |
| Consider hunting for clusters of simultaneous CPDLC session disconnects affecting multiple aircraft, which could indicate broadcast control frame attacks (CVE-2025-71411). | CPDLC session state logs with timestamps and disconnect reasons across multiple aircraft | Impact | Medium — legitimate system-wide maintenance or RF interference events could cause similar patterns. |
| Consider hunting for repeated AVLC X.25 session resets on individual aircraft connections, which could indicate malformed frame injection (CVE-2025-71413). | AVLC frame-level logs with reset counters and sequence number tracking | Impact | High — RF interference and normal handover between ground stations can cause legitimate resets. |
| Consider hunting for CPDLC emergency or status messages that do not correlate with corresponding aircraft transponder or voice communication confirmations, which could indicate false message injection (CVE-2025-71412). | Cross-correlation of CPDLC message logs with voice communication records and transponder data | Execution | Low to Medium — emergency messages without corroborating signals are inherently suspicious but could result from system delays. |
Control Gaps
- Standard IT firewalls and IDS/IPS have no visibility into VHF radio frequency communications
- EDR solutions cannot monitor avionics or ground station CPDLC protocol stacks
- The protocol itself lacks authentication, meaning traditional identity-based access controls do not apply
- No SIEM correlation rules exist for aviation data link protocols in typical SOC deployments
Key Behavioral Indicators
- CPDLC messages from unauthorized or unrecognized ground station identifiers
- Multiple simultaneous CPDLC session disconnects within a short time window
- Repeated AVLC X.25 resets on sustained connections without RF interference explanation
- CPDLC emergency or status messages lacking corroborating transponder or voice communication data
- Unnumbered Disconnect frames not preceded by normal session teardown sequences
False Positive Assessment
Medium — legitimate RF interference, ground station handovers, and system maintenance can produce session resets and disconnect patterns similar to those caused by the vulnerabilities. Cross-correlation with voice communication and transponder data would be needed to reduce false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Review current CPDLC over ATN-B1 deployments against the affected version list to confirm exposure.
- Consider increasing monitoring of CPDLC session logs for anomalous disconnect patterns, unexpected message content, or messages from unrecognized ground station identifiers.
- If suspicious activity is observed, consider following established internal procedures and reporting findings to CISA for tracking and correlation.
- Evaluate whether operational procedures can emphasize voice communication verification for safety-critical CPDLC clearances as an interim compensating control.
Infrastructure Hardening
- Consider engaging with aviation data link equipment vendors to request authentication and integrity controls for VHF Data Link and CPDLC message flows.
- Evaluate whether RF monitoring capabilities can be deployed at critical ground stations to detect anomalous transmissions from unauthorized sources.
- If applicable, consider network segmentation between CPDLC ground infrastructure and general IT networks to limit lateral access to data link systems.
- Consider reviewing ground station access controls and physical security to reduce the risk of rogue station deployment.
User Protection
- Consider briefing flight crews and air traffic controllers on the potential for false CPDLC messages and the importance of cross-verifying unexpected clearances via voice communication.
- If supported by operational procedures, consider implementing a protocol where safety-critical CPDLC instructions are confirmed through a secondary channel before execution.
Security Awareness
- Consider incorporating awareness of RF-based aviation communication vulnerabilities into existing training programs for air traffic controllers and flight operations personnel.
- If applicable, consider training operational staff to recognize indicators of CPDLC session manipulation, such as unexpected disconnects or unusual message sequences.
- Consider reviewing and updating incident reporting procedures to include suspected CPDLC or data link anomalies as a reportable category.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping4 techniques
Tactic
Execution
Tactic
Credential Access
Stay currentSubscribe via RSS
