CVE-2025-71409: VHF Data Link Auth Bypass Vulnerability

CVE-2025-71409 Overview

CVE-2025-71409 documents a missing authentication weakness in Very High Frequency Data Link (VDL) communications used to carry Controller-Pilot Data Link Communications (CPDLC) messages. The protocol does not authenticate the sender of VDL messages. A rogue ground station operating within radio range can inject forged CPDLC messages that appear to originate from a legitimate air traffic control facility. Injected messages can deliver unexpected or misleading clearances to flight crews and cause pilot confusion. The issue is classified under CWE-306: Missing Authentication for Critical Function. CISA published details in ICS Advisory ICSA-26-219-01.

Critical Impact
Unauthenticated radio-frequency injection of CPDLC messages can present forged air traffic control clearances to flight crews, undermining the integrity of controller-pilot communications.

Affected Products

Avionics and ground systems implementing VDL Mode 2 CPDLC without message authentication
Aircraft Communications Addressing and Reporting System (ACARS) endpoints relaying unauthenticated CPDLC traffic
Air traffic services data link infrastructure operating on VHF aeronautical frequencies

Discovery Timeline

2026-08-07 - CVE-2025-71409 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2025-71409

Vulnerability Analysis

CPDLC is a text-based data link used between air traffic controllers and flight crews to exchange clearances, requests, and reports. The messages are transported over VDL Mode 2 on VHF aeronautical frequencies. The underlying link and application layers do not verify the identity of the transmitting station or the integrity of the message payload.

An attacker with a software-defined radio and VDL Mode 2 protocol stack can craft CPDLC uplinks that reference a target aircraft address and a spoofed controlling authority. The receiving avionics accept these messages and display them to the flight crew as legitimate ATC instructions. Because the exchange is text-based and mimics normal controller phraseology, the crew has limited technical means to distinguish forged messages from authentic ones during a routine data link session.

Root Cause

The root cause is the absence of cryptographic authentication and integrity protection on VDL Mode 2 CPDLC messages. The protocol relies on procedural trust and radio propagation characteristics rather than digital signatures, message authentication codes, or mutual authentication between the aircraft and the ground station.

Attack Vector

The attack is carried out remotely over radio frequency. The attacker requires proximity sufficient for VHF signal reception at the target aircraft, VDL Mode 2 transmit capability, and knowledge of the target aircraft's 24-bit ICAO address and current CPDLC logon state. No credentials or interaction with the legitimate ground station are needed. The vulnerability is described in ICS Advisory ICSA-26-219-01.

No public exploit code has been released, and no verified proof-of-concept is available. The vulnerability is described in prose only; readers should consult the CISA advisory for protocol-level detail.

Detection Methods for CVE-2025-71409

Indicators of Compromise

CPDLC messages received from a facility identifier that does not match the current controlling authority for the flight's position
Duplicate or contradictory clearances arriving within a short interval on the same data link session
VDL Mode 2 transmissions observed from ground station locations inconsistent with published ATC infrastructure

Detection Strategies

Correlate CPDLC message metadata against expected controlling authority handoff sequences derived from flight plan and sector data
Cross-check data link clearances against voice ATC instructions when discrepancies appear
Monitor VDL Mode 2 spectrum for transmitters emitting valid frames from unauthorized geographic locations

Monitoring Recommendations

Log all CPDLC uplinks and downlinks at the ground data link service provider with timestamps and originating facility identifiers
Implement anomaly detection on CPDLC message rates, sender identifiers, and message sequence numbers per flight
Establish a reporting channel for flight crews to flag suspected spoofed data link clearances for post-flight analysis

How to Mitigate CVE-2025-71409

Immediate Actions Required

Require flight crews to verify any unexpected, ambiguous, or safety-critical CPDLC clearance with the controlling authority over voice before acting
Coordinate with air navigation service providers and aircraft operators to review procedures for handling conflicting or unusual data link messages
Track guidance updates published in CISA ICS Advisory ICSA-26-219-01

Patch Information

No vendor patch is listed in the NVD entry. Remediation depends on protocol-level changes to VDL Mode 2 CPDLC to introduce sender authentication and message integrity, along with corresponding updates to avionics and ground systems. Operators should follow guidance from their airframe manufacturer, avionics supplier, and civil aviation authority.

Workarounds

Use voice ATC readback and confirmation for clearances that materially change route, altitude, or speed
Where supported, restrict CPDLC logon to expected controlling authorities based on flight information region and sector
Retain and review CPDLC session logs to support post-event investigation of suspected injection attempts

bash

# No configuration example is available for this protocol-level issue.
# Refer to ICSA-26-219-01 for authoritative operational guidance.