EUVD-2025-210653
GHSA-pf92-3h27-4fqj
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
RF injection requires no system privileges, only radio equipment and proximity; AC:H captures AVLC frame-crafting complexity; vendor's PR:L assignment is not concurred with.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
Lifecycle Timeline
1DescriptionCVE.org
Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio frequency.
AnalysisAI
Session termination via injected radio frames threatens Controller-Pilot Data Link Communications (CPDLC), a safety-critical aviation channel used globally between aircraft and air traffic control for ATC clearances, weather, and route updates. Remotely transmitted Unnumbered Disconnect (U DISC) frames or malformed Aviation VHF Link Control (AVLC) frames over VHF radio can forcibly collapse active CPDLC sessions, forcing reversion to voice communication and degrading controller throughput in high-traffic airspace. No public exploit code has been identified at time of analysis; however, the ICS-CERT advisory ICSA-26-219-01 confirms the vulnerability and the aviation safety context elevates operational priority well beyond what the numeric CVSS score alone suggests.
Technical ContextAI
VHF Data Link Mode 2 (VDL Mode 2) is the ICAO-standardized data link protocol underlying CPDLC, operating in the aviation VHF band (typically 136.9 MHz). The Aviation VHF Link Control (AVLC) layer provides connection-oriented framing analogous to HDLC/LAPB, and the Unnumbered Disconnect (U DISC) frame is a legitimate AVLC control primitive used to tear down a VDL connection. The vulnerability arises because AVLC implementations do not authenticate or validate the originating party of U DISC or control frames before acting on them - an unauthenticated station within RF range can transmit a spoofed disconnect or malformed control frame and the receiving endpoint will process it without challenge. CWE-770 (Allocation of Resources Without Limits or Throttling) reflects the protocol's failure to rate-limit or filter these control primitives, allowing repeated injection without restriction. No specific vendor CPE strings were included in the NVD data; the precise affected implementations must be obtained from the CISA advisory.
RemediationAI
Consult CISA ICS advisory ICSA-26-219-01 at https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01 for vendor-specific patch guidance; no exact patched version is independently confirmable from available data, and no vendor-released patch is confirmed at time of analysis. Because patching aviation avionics is a regulated, time-intensive process requiring FAA, EASA, or applicable airworthiness authority approval, compensating controls are operationally critical: ATC ground station operators should implement monitoring for anomalous U DISC frame rates and configure alerting on sudden CPDLC session termination spikes, enabling rapid detection of injection attempts. Aircraft operators should verify that crew abnormal procedures for unexpected CPDLC loss are current and practiced, ensuring timely and proficient reversion to voice. Where VDL ground station equipment supports it, operators should engage their vendor to explore AVLC frame source validation or control-frame rate limiting - noting that protocol-level changes may themselves require airworthiness approval. Any avionics software modification must be coordinated with the equipment manufacturer and the applicable airworthiness authority before deployment.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today