CVE-2025-71410

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-08-07

Last updated on: 2026-09-29

Assigner: ICS-CERT

Description

Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames can terminate sessions and lead to a loss of CPDLC functions requiring a reversion to voice communication and increased controller workload. This type of attack can be carried out remotely over radio frequency.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-09-29

Generated

2026-10-07

AI Q&A

2026-08-07

EPSS Evaluated

2026-10-06

NVD

CVE-2025-71410

EUVD

EUVD-2025-210653

Affected Vendors & Products

Vendor	Product	Version / Range
ATN-B1	CPDLC	All versions

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability involves Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames that can terminate communication sessions. It leads to loss of Controller-Pilot Data Link Communications (CPDLC) functions, forcing a switch back to voice communication and increasing controller workload. The attack can be executed remotely via radio frequency.

Detection Guidance

Detection of this vulnerability requires monitoring for Unnumbered Disconnect (U DISC) and malformed Aviation Very High Frequency Link Control frames. Use packet capture tools like tcpdump or Wireshark to analyze radio frequency traffic for abnormal session terminations or malformed frames. Check aviation communication logs for unexpected CPDLC function losses.

Impact Analysis

This vulnerability can disrupt critical aviation communication systems, causing loss of data link functions. This may lead to increased reliance on voice communication, higher controller workload, and potential safety risks due to miscommunication or delays in air traffic management.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to aviation communication systems rather than data privacy or healthcare records. The impact is operational, disrupting air traffic control functions.

Mitigation Strategies

Implement monitoring for unusual Aviation Very High Frequency Link Control frame patterns or session terminations. Ensure redundant communication channels are available to revert to voice communication if CPDLC functions are disrupted.

Hi! I’m here to help you understand CVE-2025-71410. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70