Vulnerabilities in ATN-B1 Controller Pilot Data Link Communications (CPDLC)

The Controller Pilot Data Link Communications (CPDLC) protocol over Aeronautical Telecommunication Network Baseline 1 (ATN-B1) contains critical design-level vulnerabilities stemming from the use of legacy, clear-text, and unauthenticated radio frequency (RF) links. Researchers identified that these flaws allow for unauthorized message injection, denial-of-service (DoS) attacks, and forced session resets.

Specific vulnerabilities identified include:

• CVE-2025-71409: Lack of authentication allowing rogue ground station message injection.
• CVE-2025-71410: Use of unnumbered disconnect (U DISC) frames to terminate sessions.
• CVE-2025-71411: Use of broadcast control frames to disconnect multiple aircraft simultaneously.
• CVE-2025-71412: Injection of false emergency or status messages.
• CVE-2025-71413: Improper check for unusual or exceptional conditions.

While currently observed primarily in lab environments, these vulnerabilities pose a risk to aviation operational safety by delaying safety-critical instructions and increasing cognitive workload for flight crews and controllers. No mitigations are currently available for the affected protocol standards.

Impact

Successful exploitation of these vulnerabilities can lead to the compromise of situational awareness, operational delays in air traffic management, and potential misallocation of resources due to the injection of false emergency status messages. These issues impact the global transportation sector, specifically affecting organizations relying on the ATN-B1 CPDLC protocol for pilot-controller communications.

Recommendation

• Monitor for anomalous or unexpected CPDLC message traffic patterns within aviation communication systems.
• Establish and review internal contingency procedures for manual voice-link reversion in the event of suspected CPDLC session disruption.
• Report any suspected RF-based message injection or unsolicited session terminations to relevant national aviation authorities and CISA for correlation.
• Review the technical advisories for CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, CVE-2025-71412, and CVE-2025-71413 as they become available for updates on mitigation paths.