Remote Session Disruption in Aviation VHF Control by a Major Vendor
CVE-2025-71410

6MEDIUM

Key Information:

Vendor

Atn-b1

Status
Cpdlc
Vendor
CVE Published:
7 August 2026

What is CVE-2025-71410?

This vulnerability can allow attackers to remotely disrupt communication sessions through malformed Aviation Very High Frequency Link Control frames. Exploiting this issue may result in the termination of critical CPDLC functions, forcing operators to revert to less efficient voice communication methods. This not only complicates the communication process but also places additional strain on air traffic controllers, potentially compromising safety and operational efficiency.

Affected Version(s)

CPDLC All versions

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-2...
third-party-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Martin Strohmeier of Armasuisse reported this vulnerability to CISA.
.