What is the CVSS score of CVE-2025-1727?

CVE-2025-1727 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IoT are affected by CVE-2025-1727?

This vulnerability affects railway operations by allowing attackers to remotely manipulate End-of-Train and Head-of-Train braking systems using software-defined radios, potentially causing…

How to fix or mitigate CVE-2025-1727?

Within 24 hours: Inventory all EoT/HoT devices in operation and assess exposure to RF attack vectors; notify rail operations and safety teams of the vulnerability. Within 7 days: Implement physical RF shielding or operational controls to restrict RF access near critical rail equipment; establish enhanced monitoring for anomalous brake commands. Within 30 days: Coordinate with equipment vendors for patch availability; conduct penetration testing of RF controls; develop incident response procedures specific to brake command injection attacks.

IoT CVE-2025-1727

EUVD-2025-21087 HIGH

Weak Authentication (CWE-1390)

2025-07-10 ics-cert@hq.dhs.gov

IoT SCADA Industrial Authentication Bypass Denial Of Service

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 06:52 euvd

EUVD-2025-21087

Analysis Generated

Mar 16, 2026 - 06:52 vuln.today

CVE Published

Jul 10, 2025 - 23:15 nvd

HIGH 8.1

DescriptionCVE.org

The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and issue brake control commands to the EoT device, disrupting operations or potentially overwhelming the brake systems.

AnalysisAI

CVE-2025-1727 is a critical vulnerability in RF-based remote linking protocols used for End-of-Train (EoT) and Head-of-Train (HoT/FRED) devices in railway operations. The vulnerability exploits a weak BCH checksum implementation that allows attackers to forge brake control commands using software-defined radios (SDR), potentially disrupting train operations or overwhelming brake systems. This affects railway infrastructure globally, with a CVSS score of 8.1 indicating high severity; active exploitation status and proof-of-concept availability are critical factors that determine immediate priority despite the attack requiring physical/adjacent network proximity.

Technical ContextAI

The vulnerability resides in the RF communication protocol layer used for train consist monitoring and control systems. End-of-Train and Head-of-Train devices rely on Bose-Chaudhuri-Hocquenghem (BCH) error-correcting codes for packet integrity verification. BCH checksums, while useful for detecting transmission errors, are not cryptographically secure and can be mathematically forged by an attacker with knowledge of the checksum algorithm. The root cause maps to CWE-1390 (Weak Authentication), indicating insufficient authentication mechanisms in the RF protocol—specifically, the absence of cryptographic message authentication codes (MAC) or digital signatures. An attacker with access to SDR equipment can analyze captured packets, compute valid BCH checksums for malicious brake command payloads, and transmit forged commands that the EoT/HoT devices will accept as legitimate. This is particularly dangerous because railway brake systems are safety-critical: flooding with brake commands could cause unintended braking, loss of train control, or derailment in severe cases.

RemediationAI

Immediate remediation requires: (1) Firmware updates from device manufacturers that replace BCH checksum validation with cryptographically secure message authentication (HMAC-SHA256 or AES-CMAC); (2) Protocol updates implementing symmetric or asymmetric encryption for RF command channels; (3) Rollout of updated RF receivers that reject unauthenticated brake commands. Short-term mitigations pending patches: (a) Operational security controls—restrict train operations to secured rail yards or main lines with monitored RF environments; (b) RF shielding or frequency-hopping protocols to increase attack difficulty; (c) Enhanced monitoring for anomalous brake command patterns via consist telemetry; (d) Disable remote RF brake control where operationally feasible, reverting to hardwired or verified-secure control channels. Manufacturers should issue security advisories with patch timelines immediately. Regulatory bodies (FRA in US, RSSB in UK, ERA in EU) should coordinate with operators to ensure coordinated deployment. Patches should be backward-compatible where possible to avoid fleet-wide downtimes.