Vulnerability in VHF Data Link Messages Affects Aviation Products
CVE-2025-71409

7.1HIGH

Key Information:

Vendor

Atn-b1

Status
Cpdlc
Vendor
CVE Published:
7 August 2026

What is CVE-2025-71409?

A critical lapse in authentication within Very High Frequency Data Link systems enables unauthorized entities to inject Control Pilot Data Link Communications (CPDLC) messages. This flaw creates the potential for misleading instructions and confusion among pilots, compromising flight safety. Attackers can exploit this vulnerability from remote locations using radio frequency, indicating a significant risk in aviation communication systems.

Affected Version(s)

CPDLC All versions

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Martin Strohmeier of Armasuisse reported this vulnerability to CISA.
.