Which versions of VHF Data Link are affected by CVE-2025-71409?

CVE-2025-71409 exposes a critical authentication gap in aircraft CPDLC systems (Controller-Pilot Data Link Communications), enabling rogue ground stations to inject unauthorized air traffic control…

How to fix or mitigate CVE-2025-71409?

Within 24 hours: Inventory all aircraft and ground systems using CPDLC/VDL, notify aviation regulatory bodies (FAA, EUROCONTROL) and commercial operators, and escalate to aircraft manufacturers and avionics suppliers for emergency advisory. Within 7 days: Engage vendors (Airbus, Boeing, major avionics OEMs) to prioritize authentication patch development; deploy interim compensating controls including ground-station identity verification procedures, radio-frequency monitoring for rogue transmitters, and mandatory crew message validation training. Within 30 days: Coordinate with regulators on emergency airworthiness directives; establish metrics for tracking potential exploitation attempts; prepare rapid deployment procedures for vendor patches when released; institutionalize procedures for flight crews to verify and report anomalous CPDLC messages.

VHF Data Link CVE-2025-71409

Q: What is the CVSS score of CVE-2025-71409?

CVE-2025-71409 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210654 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-07 ics-cert@hq.dhs.gov

GHSA-pf5c-m7c5-xfm9

Authentication Bypass

7.1

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Specialized VHF radio hardware required drives AC:H and PR:L; scope change to S:C because injection integrity impact extends beyond cockpit to air traffic control system.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 19:31 vuln.today

CVE Published

Aug 07, 2026 - 19:17 cve.org

HIGH 7.1

DescriptionCVE.org

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

AnalysisAI

Missing authentication in VHF Data Link (VDL) CPDLC (Controller-Pilot Data Link Communications) enables rogue ground stations to inject unauthorized clearance messages into cockpit avionics over radio frequency. Pilots receiving spoofed CPDLC messages may follow misleading ATC instructions - altitude changes, heading redirections, or route modifications - with no indication the messages are inauthentic. This ICS-CERT advisory (ICSA-26-219-01) exposes a systemic protocol-level authentication gap with no public exploit identified at time of analysis.

Technical ContextAI

CPDLC is a digital text-based air-ground communication system that supplements voice radio between pilots and air traffic controllers, transmitted via VHF Data Link Mode 2 (VDLm2) operating in the 136-137 MHz aviation band. The vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function): the VDL protocol lacks cryptographic authentication or integrity verification on uplinked messages, meaning any transmitter capable of emitting valid-format VDL packets can deliver CPDLC messages to aircraft avionics. There is no mechanism for the aircraft's Flight Management System or ACARS/CPDLC processor to distinguish legitimate ATC ground station transmissions from rogue ones. This is a protocol-design-level flaw rather than a software implementation bug in a single vendor product, which means it affects all compliant VDLm2 implementations.

RemediationAI

Consult CISA ICS Advisory ICSA-26-219-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01 for vendor-specific guidance; no vendor-released patch version is independently confirmed from the available data. Because this is a protocol-level authentication gap in VDLm2, software patches alone may be insufficient without protocol extensions or avionics firmware changes. Specific compensating controls include: implementing ground-side message authentication extensions where avionics equipment supports them; training flight crews to cross-validate unexpected or unusual CPDLC clearances via voice ATC before acting, which serves as a procedural backstop; deploying RF monitoring near controlled airspace to detect anomalous VDL transmissions from unauthorized sources; and operationally treating ambiguous CPDLC instructions with heightened scrutiny pending a protocol-level fix. Restricting automatic CPDLC acceptance for altitude-critical clearances reduces exposure but may affect operational efficiency.