CVE-2025-71410: Aviation VHF Link Control DoS Vulnerability

CVE-2025-71410 Overview

CVE-2025-71410 affects Aviation Very High Frequency (VHF) Link Control implementations used in Controller-Pilot Data Link Communications (CPDLC). Attackers can send Unnumbered Disconnect (U DISC) frames or malformed link control frames over radio frequency to terminate active sessions. The resulting loss of CPDLC forces a reversion to voice communication and increases controller workload. CISA published advisory ICSA-26-219-01 covering this issue. The weakness is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. The vulnerability is remotely exploitable over RF without physical access to aviation ground or airborne systems.

Critical Impact
Remote radio-frequency attackers can terminate CPDLC data-link sessions, forcing air traffic controllers to revert to voice communications and increasing operational workload.

Affected Products

Aviation VHF Link Control (AVLC) protocol implementations
Controller-Pilot Data Link Communications (CPDLC) systems
VHF Data Link (VDL) Mode 2 aviation datalink equipment

Discovery Timeline

2026-08-07 - CVE-2025-71410 published to the National Vulnerability Database
2026-08-10 - CVE-2025-71410 last updated in NVD

Technical Details for CVE-2025-71410

Vulnerability Analysis

The vulnerability resides in the Aviation VHF Link Control (AVLC) frame processing layer that underpins VDL Mode 2 communications. AVLC uses HDLC-derived frame types, including Unnumbered Disconnect (U DISC) frames that legitimately end a link session between an aircraft and a ground station. The implementation does not adequately authenticate or rate-limit incoming frames, so any transmitter on the correct frequency can inject session-terminating traffic. Malformed link control frames produce a similar effect by driving the state machine into an error condition that tears down the session. Loss of CPDLC removes the digital text-based channel used for clearances and route amendments. Controllers must then handle the affected aircraft via voice, which reduces sector capacity and raises workload during high-density operations.

Root Cause

The root cause is missing resource and session controls in the AVLC state machine, aligned with [CWE-770]. The protocol trusts inbound U DISC and control frames without cryptographic authentication or throttling, allowing spoofed frames to close legitimate sessions.

Attack Vector

An attacker within RF range of the target aircraft or ground station transmits crafted AVLC frames on the VDL Mode 2 frequency. The attack requires knowledge of the target link parameters but does not require credentials on the aviation network. No exploit code is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. See the CISA ICS Advisory ICSA-26-219-01 for technical details from the coordinating agency.

Detection Methods for CVE-2025-71410

Indicators of Compromise

Unexpected AVLC U DISC frames arriving on active CPDLC sessions outside normal handoff windows.
Bursts of malformed link control frames on VDL Mode 2 frequencies coinciding with session drops.
Repeated CPDLC session re-establishment events for the same aircraft over a short interval.

Detection Strategies

Correlate CPDLC session termination logs against RF spectrum monitoring to identify anomalous transmitters.
Baseline normal U DISC frame rates per ground station and alert on statistical deviations.
Monitor for AVLC frames that fail CRC or protocol conformance checks in datalink processors.

Monitoring Recommendations

Enable verbose logging of AVLC state transitions on ground-station datalink servers.
Ingest datalink and RF telemetry into a centralized analytics pipeline for cross-source correlation.
Coordinate with local spectrum management to detect unauthorized transmitters on VDL Mode 2 channels.

How to Mitigate CVE-2025-71410

Immediate Actions Required

Review the CISA ICS Advisory ICSA-26-219-01 and apply vendor guidance for affected AVLC and CPDLC equipment.
Establish operational procedures for rapid voice fallback when CPDLC sessions terminate unexpectedly.
Notify air traffic and flight operations personnel of the risk and expected response actions.

Patch Information

No specific vendor patch identifiers are listed in the CVE record. Operators should track updates from their AVLC and CPDLC equipment vendors and follow remediation instructions published in the CISA advisory.

Workarounds

Increase reliance on voice communications as a redundant channel in high-threat environments.
Deploy RF direction-finding capabilities near critical ground stations to locate rogue transmitters.
Coordinate with the aviation authority to raise session re-establishment timers and reduce repeated denial impact.

bash

# Configuration example not available; consult vendor advisories referenced in ICSA-26-219-01.