EUVD-2025-210652
GHSA-3rjh-r4h7-c3mq
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
RF-based remote attack requires proximity and protocol knowledge (AC:H); PR:L reflects non-zero capability barrier; pure availability impact with no confidentiality or integrity loss.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency.
AnalysisAI
Denial-of-service via spoofed broadcast control frames over radio frequency can simultaneously disconnect multiple aircraft from air traffic control datalink communications, causing controller overload and delayed clearances. The vulnerability is classified ICS-critical and reported through CISA ICS-CERT (ICSA-26-219-01), indicating a fielded aviation infrastructure component is affected. No public exploit code has been identified at time of analysis, though the attack is described as remotely executable over RF with low privilege requirements, making it a meaningful operational risk at any airport deploying the affected system.
Technical ContextAI
CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the affected aviation communication system does not properly rate-limit, authenticate, or validate incoming broadcast control frames on the radio frequency channel. In aviation datalink environments - such as VHF Data Link (VDL Mode 2) or similar ground-to-air digital communication protocols - broadcast frames are used to manage link-layer connectivity across multiple aircraft simultaneously. A system vulnerable to CWE-770 accepts and processes unauthenticated broadcast frames without throttling, allowing a malicious transmitter to inject frames that command disconnection or resource exhaustion across all aircraft currently on the channel. No CPE strings were provided; exact affected product and vendor are identifiable only via the CISA advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01.
RemediationAI
Consult CISA ICS Advisory ICSA-26-219-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01 for vendor-specific patch guidance; no exact fix version is independently confirmed from the available data. As a compensating control pending patching, operators should implement RF anomaly detection and monitoring on aviation communication channels to detect abnormal broadcast frame volumes or sources. Where technically feasible, configure ground-station equipment to validate or rate-limit incoming broadcast control frames, though this may require coordination with avionics authorities given protocol constraints. Restricting physical RF access near airport perimeters and coordinating with aviation regulators regarding unauthorized transmitters on protected aviation frequencies can reduce attack surface. Any filtering or rate-limiting applied to the datalink channel carries a trade-off risk of disrupting legitimate aircraft communications and should be tested against operational continuity requirements before deployment.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today