{"id":"CVE-2025-71413","state":"PUBLISHED","title":"In CPDLC, Malformed or Out of Sequence Frames Can Cause Resets","description":"Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency.","publishedAt":"2026-08-07T19:00:53.989Z","updatedAt":"2026-08-10T21:13:25.958Z","severity":{"score":6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["ATN-B1 CPDLC"],"affected":[{"vendor":"ATN-B1","product":"CPDLC","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01"],"weaknesses":["CWE-754"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/71xxx/CVE-2025-71413.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-71413","state":"PUBLISHED","datePublished":"2026-08-07T19:00:53.989Z","dateUpdated":"2026-08-10T21:13:25.958Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2026-08-04T20:31:35.645Z"},"containers":{"cna":{"title":"In CPDLC, Malformed or Out of Sequence Frames Can Cause Resets","descriptions":[{"lang":"en","value":"Malformed or out-of-sequence frames at the Aviation Very High Frequency Link Control X.25 layers cause repeated resets which may result in increased workload and reduced situational awareness. This type of attack can be carried out remotely over radio frequency."}],"affected":[{"vendor":"ATN-B1","product":"CPDLC","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":6,"vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-754","lang":"en","description":"CWE-754","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2026-08-07T19:00:53.989Z"},"datePublic":"2026-08-07T18:00:00.000Z","workarounds":[{"lang":"en","value":"These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting.","supportingMedia":[{"type":"text/html","base64":false,"value":"These vulnerabilities in the CPDLC protocol stack are exploitable in a lab environment. However, they require very specific conditions to be met and are unlikely to be exploited outside of a lab setting.<br>"}]},{"lang":"en","value":"Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.","supportingMedia":[{"type":"text/html","base64":false,"value":"Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.&nbsp;&nbsp;"}]}],"credits":[{"lang":"en","value":"Martin Strohmeier of Armasuisse reported this vulnerability to CISA.","type":"finder"}],"source":{"advisory":"ICSA-26-219-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.4"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-10T18:48:49.983734Z","id":"CVE-2025-71413","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-10T21:13:25.958Z"}}]}}}