CPDLC aviation data link is missing authentication at protocol level
Five CVEs with no available mitigations confirm the problem isn't a bug that can be patched, it's a protocol that was never designed to authenticate the sender, and aircraft worldwide fly with it
TL;DR
CISA published five vulnerabilities (CVE-2025-71409 through CVE-2025-71413) in the Controller-Pilot Data Link Communications protocol over ATN-B1, the aviation data link used globally for air traffic control messaging. All protocol versions are affected. The flaws allow unauthenticated message injection, session termination, and denial-of-service over radio frequency. CVSS 7.1. No mitigations exist, because the vulnerabilities are structural: the protocol operates over cleartext, unauthenticated VHF links by design. CISA assesses lab exploitation as feasible but real-world exploitation as "unlikely" given high attack complexity and the specific conditions required, an assessment whose operational assumptions are worth examining across different ATM architectures.
These aren't ordinary ICS vulnerabilities. Most CISA advisories identify a buffer overflow or an authentication bypass in a specific vendor's product, and a patch arrives within weeks. What CISA disclosed here is different: the CPDLC over ATN-B1 data link protocol (the digital backbone of controller-pilot communications in controlled airspace worldwide) has no mechanism for authenticating who sent a message. It never did.
The five CVEs are all expressions of that single underlying condition. CVE-2025-71409 is the headline: a rogue ground station can inject CPDLC messages that produce misleading clearances on the flight deck. CVE-2025-71410 lets an attacker terminate CPDLC sessions with unnumbered disconnect frames, forcing controllers and pilots back to voice, which scales poorly when the attacker can target multiple aircraft simultaneously, as CVE-2025-71411 describes via broadcast control frames. CVE-2025-71412 covers false emergency or status message injection that can misallocate air traffic resources. CVE-2025-71413 rounds out the set with malformed frames at the X.25 layer that cause repeated resets and loss of situational awareness.
Every one of them is exploitable remotely, over radio frequency, without authentication. The affected product isn't a piece of hardware from a named vendor, it's the protocol itself, referenced in FAA Advisory Circular 90-117, deployed in aircraft and ground stations across every ICAO region. The "affected versions" field says "vers:all/*" because there is no version of ATN-B1 CPDLC that fixes this.
Why there's no patch
The mitigation section is the tell. CISA's standard template includes a "Remediations" field. Here it reads: "None available. Currently, there is no mitigation available for CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, CVE-2025-71412, CVE-2025-71413." That isn't a vendor dragging its feet. It's a recognition that authentication can't be bolted onto a protocol whose entire deployed base assumes cleartext VHF data link with no cryptographic handshake. Fixing this means a successor protocol, not a firmware update.
The advisory's risk framing is careful. CISA says the vulnerabilities "do not constitute an unsafe aircraft condition" but "can degrade operational safety margins by increasing workload, delaying safety-critical instructions, and reducing situational awareness." That's the correct regulatory distinction (the aircraft still flies) but it understates what degraded CPDLC looks like in congested airspace. When controllers lose data link, they revert to voice. Voice doesn't scale. A single attacker injecting disconnect frames across a sector can saturate voice frequencies and force controllers into separation standards that cut throughput.
"Unlikely" needs unpacking
CISA states real-world exploitation is "unlikely" because the vulnerabilities "require very specific conditions to be met." That's a fair characterization of lab-to-field translation for most ICS vulnerabilities. But the conditions here (proximity to an aircraft or ground station within VHF range, a software-defined radio, and knowledge of the protocol) aren't exotic. They're the baseline capability set of any well-resourced actor who has read the ICAO technical standards for ATN-B1, which are published. The advisory doesn't specify what operational conditions CISA believes prevent exploitation outside labs, and that gap matters for operators trying to assess their own exposure.
What operators should do Monday
There's no patch. There won't be one. The response is architectural: review controller fallback procedures for CPDLC outages, stress-test voice-reversion workflows under partial data link degradation, and assess whether your ATM infrastructure assumes CPDLC integrity in ways that are no longer safe to assume. For aircraft operators, confirm that flight crews are trained to recognize and challenge anomalous clearances delivered via data link, and that those procedures are exercised, not just documented.
The protocol layer problem CISA just made public has existed since ATN-B1 was standardized. What changed this week is that it's now catalogued, scored, and searchable by anyone with an NVD query.
Published ·Deep Fathom