CVE-2025-71412 Overview
CVE-2025-71412 describes a message injection weakness in Controller-Pilot Data Link Communications (CPDLC), a text-based air-to-ground messaging protocol used between flight crews and air traffic controllers. Attackers with radio frequency access can inject false emergency or status messages into CPDLC traffic. The forged messages can mislead pilots, controllers, and ground operations into misallocating resources or taking improper response actions. CISA published guidance for this issue in advisory ICSA-26-219-01. The underlying weakness maps to [CWE-754: Improper Check for Unusual or Exceptional Conditions].
Critical Impact
Remote radio-frequency injection of falsified CPDLC messages can drive operational confusion and unsafe responses by aviation personnel.
Affected Products
- Systems implementing Controller-Pilot Data Link Communications (CPDLC)
- Air traffic control ground stations processing CPDLC traffic
- Aircraft avionics receiving CPDLC uplink messages
Discovery Timeline
- 2026-08-07 - CVE-2025-71412 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2025-71412
Vulnerability Analysis
CPDLC transmits controller-pilot instructions and status information over radio frequency data links. The protocol, as deployed, does not adequately verify the authenticity or origin of received messages. An attacker with a suitable radio transmitter can craft and broadcast frames that appear to originate from a legitimate controller or aircraft. Recipients process these frames as trusted operational messages.
The injected content can include false emergency declarations, altitude or heading directives, or spurious status updates. Flight crews may execute unnecessary maneuvers, and controllers may reroute traffic or dispatch emergency response based on fabricated data. Ground operations teams may commit resources to non-existent events. The integrity impact is high while confidentiality remains unaffected, because the attack manipulates rather than reads traffic.
Root Cause
The root cause is improper handling of exceptional conditions on the receiving side of the CPDLC data link ([CWE-754]). Message authenticity checks are insufficient to reject frames that were not generated by an authorized peer, allowing forged emergency and status content to be accepted as valid.
Attack Vector
Exploitation requires radio-frequency transmission capability within range of CPDLC receivers and knowledge of protocol framing. No credentials on any IT network are required. The attack is remote over the air interface, does not require user interaction, and the attacker needs only low privileges relative to the radio medium. Attack complexity is high because timing, frequency, and message construction must align with an active CPDLC session.
Detection Methods for CVE-2025-71412
Indicators of Compromise
- CPDLC messages received from unexpected transmitter locations or with anomalous signal characteristics
- Emergency or status uplinks that are not corroborated by voice communications or radar data
- Duplicate or out-of-sequence CPDLC message identifiers within an active session
- Controller or crew reports of instructions that neither party issued
Detection Strategies
- Cross-verify CPDLC directives against voice channel confirmations and surveillance data before action
- Monitor CPDLC session logs for message identifier gaps, replays, or origin inconsistencies
- Deploy radio-frequency direction finding to correlate CPDLC transmissions with authorized ground station locations
- Alert on emergency declarations arriving via CPDLC without matching transponder or voice indications
Monitoring Recommendations
- Retain full CPDLC transaction logs at ground stations for forensic replay and correlation
- Establish baselines for expected CPDLC traffic volume and message types per sector
- Integrate CPDLC anomaly alerts into air traffic operations center workflows for immediate review
How to Mitigate CVE-2025-71412
Immediate Actions Required
- Review CISA advisory ICSA-26-219-01 and apply the operational recommendations issued to aviation stakeholders
- Require voice confirmation for any emergency or non-routine CPDLC instruction before crews or controllers act
- Brief flight crews and controllers on the specific injection scenario and reporting procedures
Patch Information
No software patch is identified in the enriched data. CPDLC is a protocol used across multiple avionics and ground system vendors, and mitigations are operational and procedural. Refer to the CISA ICS Advisory ICSA-26-219-01 for authoritative guidance.
Workarounds
- Treat unverified CPDLC emergency or status messages as suspect until confirmed through an independent channel
- Use voice communications to validate high-consequence instructions such as altitude changes or diversions
- Coordinate with air navigation service providers to enable cryptographic authentication where supported by newer data link standards
- Report suspected injection events to the responsible civil aviation authority and CISA
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
