Which versions of CPDLC are affected by CVE-2025-71412?

CVE-2025-71412 enables remote attackers to inject false emergency and operational messages into CPDLC avionics and air traffic control ground systems, potentially causing flight crews and controllers…

How to fix or mitigate CVE-2025-71412?

Within 24 hours: Inventory all CPDLC-equipped aircraft, avionics systems, and ATC ground systems in your operational environment; initiate coordination with your aviation regulator (FAA, EASA, or equivalent) and all CPDLC system vendors to obtain current advisory status and patch timelines. Within 7 days: Deploy RF signal monitoring and anomaly detection on CPDLC communication channels; mandate dual-verification of all emergency and critical operational messages via independent voice communication as a procedural control; restrict CPDLC message priority access to essential operations. Within 30 days: Conduct security assessments of all CPDLC implementations with your avionics vendors; evaluate firmware updates or configuration hardening options from system manufacturers; perform incident response exercises simulating false CPDLC message injection to validate crew and ATC procedures.

CPDLC CVE-2025-71412

Q: What is the CVSS score of CVE-2025-71412?

CVE-2025-71412 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2025-210651 HIGH

Improper Check for Unusual or Exceptional Conditions (CWE-754)

2026-08-07 ics-cert@hq.dhs.gov

GHSA-rwj7-w96h-7phq

Code Injection

7.1

CVSS 4.0 · Vendor: hq

Severity by source

Vendor (hq) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Network via RF with high complexity for specialized equipment; low privileges for RF transmission capability; scope changes to downstream ATC and flight safety systems; no confidentiality impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Primary rating from Vendor (hq).

CVSS VectorVendor: hq

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 19:33 vuln.today

CVE Published

Aug 07, 2026 - 19:17 cve.org

HIGH 7.1

DescriptionCVE.org

Injection of false emergency or status messages over CPDLC may lead to misallocation of resources, operational confusion, and improper response actions by flight crews, traffic controllers, and ground operations. This type of attack can be carried out remotely over radio frequency.

AnalysisAI

Message injection into Controller-Pilot Data Link Communications (CPDLC) enables remote attackers operating over radio frequency to insert false emergency or operational status messages into aviation communication channels, causing flight crews, air traffic controllers, and ground operations personnel to misallocate resources or take unsafe response actions. Disclosed by CISA ICS-CERT under advisory ICSA-26-219-01, this vulnerability affects CPDLC-equipped aircraft avionics and ATC ground systems globally, with high integrity impact to both the vulnerable communication system and downstream aviation safety systems. No public exploit has been identified at time of analysis, though the high attack complexity constrains the threat actor population to technically sophisticated adversaries with aviation-domain knowledge and RF transmission capability.

Technical ContextAI

CPDLC (Controller-Pilot Data Link Communications) is an ICAO-standardized digital messaging protocol enabling text-based communication between pilots and air traffic controllers over radio frequency links including VHF ACARS (~130 MHz band), SATCOM (FANS-1/A), and HF data link. The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions), indicating the implementation fails to adequately validate or authenticate incoming CPDLC messages before presenting them to operators - a known architectural weakness in legacy aviation data link systems that historically lack cryptographic message-level authentication. Because CPDLC operates over radio frequency channels, the physical attack surface extends to any entity capable of transmitting on the relevant frequencies within range of aircraft or ground infrastructure, making this a protocol-layer injection problem rather than a traditional software memory-safety flaw. No CPE identifiers or specific vendor product names were included in the advisory data, so the affected scope is inferred from the protocol description and ICS-CERT advisory context.

RemediationAI

No vendor-released patch or specific fix version was identified in the available advisory data; refer to CISA ICS Advisory ICSA-26-219-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01) for vendor-specific guidance as it becomes available. Compensating controls include implementing CPDLC message authentication where supported - such as ICAO PKI-based message signing for ATN implementations - which requires coordinated avionics and ground system upgrades and cannot be applied unilaterally by operators. Flight crew and controller training should emphasize cross-verifying unexpected emergency or status CPDLC messages via voice radio before acting on them, accepting the trade-off of increased workload in high-tempo phases. Where avionics architecture allows, restricting CPDLC uplink processing to authenticated ground station addresses reduces the injection surface, though this depends on ATC ground system capabilities. Monitoring CPDLC message logs for anomalous senders, timing, or content inconsistent with the active ATC sector can support detection without operational disruption. Operators in high-sensitivity airspace should raise crew situational awareness procedures for anomalous CPDLC messages pending a coordinated industry patch.