CVE-2025-71412

Summary

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency.

Affected Software

Weaknesses

• CWE-754: CWE-754

Workarounds

These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01

• ←Previous
• Next→