EUVD-2025-210650
GHSA-hppf-fwr2-8p5x
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
VHF range justifies AV:N; AC:H for specialized protocol frame crafting; PR:L retained from ICS-CERT scoring reflecting specialized radio equipment requirement; pure availability impact with no C or I effect.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency.
AnalysisAI
Repeated denial-of-service resets in Aviation VHF Link Control X.25 protocol implementations can be triggered remotely over radio frequency by transmitting malformed or out-of-sequence frames. The resulting reset loop degrades communication availability and increases workload for pilots or air traffic controllers, with potential for reduced situational awareness during critical flight operations. No public exploit has been identified at time of analysis, but the radio-frequency attack vector means any actor with appropriate VHF transmitting equipment and protocol knowledge within range could attempt exploitation without authenticating to the target system.
Technical ContextAI
The affected technology is the Aviation Very High Frequency (VHF) Data Link protocol stack, which uses X.25 as its data link and network layer for air-to-ground and ground-to-air data communications - a legacy packet-switched protocol adapted for aviation use in systems such as VDL Mode 2 (VHF Digital Link). The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions): the VHF Link Control (VLC) layer implementation fails to adequately validate or gracefully discard malformed or out-of-sequence X.25 frames, instead entering a repeated reset cycle. This is characteristic of older aviation protocol stacks designed before modern adversarial RF environments were anticipated. The CVSS 4.0 vector confirms no confidentiality or integrity impact (VC:N/VI:N), only high availability impact (VA:H), consistent with a denial-of-service reset loop.
RemediationAI
The primary remediation reference is CISA ICS Advisory ICSA-26-219-01, available at https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01; no exact fix version is identifiable from the provided CVE data alone, so aviation operators must consult that advisory directly for vendor-specific patch instructions. As a compensating control pending patch deployment, operators should implement RF monitoring on aviation VHF frequencies to detect anomalous frame transmission patterns near critical infrastructure such as airports and approach corridors. Operational procedures should ensure fallback communication modes (voice VHF, secondary data link systems) remain available and crew-trained against the event that the primary VHF data link enters a reset cycle. Physical security measures limiting unauthorized proximity to airside areas reduce the practical range advantage an attacker would otherwise gain. Note that blocking or filtering malformed frames at the radio level may require firmware changes to antenna or modem hardware and could affect interoperability with legitimate ground stations - verify with the equipment vendor before implementing.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today