{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/atn-b1-cpdlc/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2025-71409"},{"cvss":5.3,"id":"CVE-2025-71410"},{"cvss":5.3,"id":"CVE-2025-71411"},{"cvss":7.1,"id":"CVE-2025-71412"},{"cvss":5.3,"id":"CVE-2025-71413"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Advisory Circular 90-117 Data Link Communications","ATN-B1 CPDLC"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Controller Pilot Data Link Communications (CPDLC) protocol over Aeronautical Telecommunication Network Baseline 1 (ATN-B1) contains critical design-level vulnerabilities stemming from the use of legacy, clear-text, and unauthenticated radio frequency (RF) links. Researchers identified that these flaws allow for unauthorized message injection, denial-of-service (DoS) attacks, and forced session resets.\u003c/p\u003e\n\u003cp\u003eSpecific vulnerabilities identified include:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2025-71409: Lack of authentication allowing rogue ground station message injection.\u003c/li\u003e\n\u003cli\u003eCVE-2025-71410: Use of unnumbered disconnect (U DISC) frames to terminate sessions.\u003c/li\u003e\n\u003cli\u003eCVE-2025-71411: Use of broadcast control frames to disconnect multiple aircraft simultaneously.\u003c/li\u003e\n\u003cli\u003eCVE-2025-71412: Injection of false emergency or status messages.\u003c/li\u003e\n\u003cli\u003eCVE-2025-71413: Improper check for unusual or exceptional conditions.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWhile currently observed primarily in lab environments, these vulnerabilities pose a risk to aviation operational safety by delaying safety-critical instructions and increasing cognitive workload for flight crews and controllers. No mitigations are currently available for the affected protocol standards.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities can lead to the compromise of situational awareness, operational delays in air traffic management, and potential misallocation of resources due to the injection of false emergency status messages. These issues impact the global transportation sector, specifically affecting organizations relying on the ATN-B1 CPDLC protocol for pilot-controller communications.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor for anomalous or unexpected CPDLC message traffic patterns within aviation communication systems.\u003c/li\u003e\n\u003cli\u003eEstablish and review internal contingency procedures for manual voice-link reversion in the event of suspected CPDLC session disruption.\u003c/li\u003e\n\u003cli\u003eReport any suspected RF-based message injection or unsolicited session terminations to relevant national aviation authorities and CISA for correlation.\u003c/li\u003e\n\u003cli\u003eReview the technical advisories for CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, CVE-2025-71412, and CVE-2025-71413 as they become available for updates on mitigation paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-07T19:48:49Z","date_published":"2026-08-07T19:48:49Z","id":"https://feed.craftedsignal.io/briefs/2026-08-atn-b1-cpdlc-vulnerabilities/","summary":"The ATN-B1 CPDLC protocol is susceptible to message injection and denial-of-service attacks due to reliance on unauthenticated, clear-text radio frequency communication.","title":"Vulnerabilities in ATN-B1 Controller Pilot Data Link Communications (CPDLC)","url":"https://feed.craftedsignal.io/briefs/2026-08-atn-b1-cpdlc-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - ATN-B1 CPDLC","version":"https://jsonfeed.org/version/1.1"}