CISA warns of five CPDLC vulnerabilities in ATN-B1 data link systems

CISA on Thursday published an advisory on five vulnerabilities in ATN-B1 controller-pilot data link communications, saying the flaws could let an attacker inject messages, force session resets and disrupt air-traffic operations.

The agency said the issues affect Advisory Circular 90-117 Data Link Communications ATN-B1 CPDLC and that no mitigation is available for the five vulnerabilities. CISA said the problems can degrade operational safety margins by increasing workload, delaying safety-critical instructions and reducing situational awareness, even though the advisory says they do not constitute an unsafe aircraft condition.

The advisory, ICSA-26-219-01, says ATN-B1 CPDLC uses legacy clear-text, unauthenticated radio-frequency links. CISA said the research demonstrated unauthorized message injection, denial-of-service conditions and forced session resets, with high attack complexity and very specific conditions needed for exploitation.

The five tracked vulnerabilities are CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, CVE-2025-71412 and CVE-2025-71413.

For CVE-2025-71409, CISA said a lack of authentication for Very High Frequency Data Link messages could allow rogue ground stations to inject CPDLC messages, causing unexpected or misleading clearances and possible pilot confusion. The advisory rates that issue 7.1, or high, under both CVSS v3.1 and v4.0.

CISA said CVE-2025-71410 involves Unnumbered Disconnect and malformed Aviation Very High Frequency Link Control frames that can terminate sessions, cut off CPDLC functions, force a return to voice communication and increase controller workload. It listed the issue as medium severity, with a 5.3 CVSS v3.1 score and a 6 CVSS v4.0 score.

The agency said CVE-2025-71411 could let broadcast control frames disconnect multiple aircraft at once, which may delay clearances and add strain on air-traffic controllers. It carries the same medium severity scores as CVE-2025-71410.

For CVE-2025-71412, CISA said false emergency or status messages sent over CPDLC could lead to misallocated resources, operational confusion and improper response actions by flight crews, traffic controllers and ground operations. The advisory rates that issue 7.1, or high, under both CVSS versions.

CISA said CVE-2025-71413 involves malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers and can lead to repeated resets, increased workload and reduced situational awareness. It is rated medium under both CVSS versions.

The advisory says no known public exploitation targeting these vulnerabilities has been reported to CISA. It also says the flaws are unlikely to be exploited outside a lab setting because of the conditions needed, though the agency still urged organizations that see suspicious activity to follow internal procedures and report findings to CISA.

CISA credited Martin Strohmeier of Armasuisse with reporting the vulnerabilities.

Sources

• CISA advisory ICSA-26-219-01, CPDLC over ATN-B1 Vulnerabilities

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.