What is CVE-2025-71409?

CVE-2025-71409 is a high-severity vulnerability in Atn-B1 Cpdlc, classified under Missing Authentication for Critical Function. CVSS score: 7.1/10. Published 2026-08-07.

How severe is CVE-2025-71409?

High severity. CVSS v3 base score is 7.1 out of 10.

Auth bypass in Atn-B1 Cpdlc

CVE-2025-71409

Lack of authentication for Very High Frequency Data Link messages allows rogue ground stations to inject CPDLC messages leading to unexpected or misleading clearances and potential pilot confusion. This type of attack can be carried out remotely over radio frequency.

Vulnerability class: Broken Authentication

EPSS: 0.002 (10.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L.

Affected products

Atn-b1 Cpdlc — versions All versions

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

ics-cert@hq.dhs.gov (third-party-advisory)

Frequently asked questions

What is CVE-2025-71409?: CVE-2025-71409 is a high-severity vulnerability in Atn-B1 Cpdlc, classified under Missing Authentication for Critical Function. CVSS score: 7.1/10. Published 2026-08-07.
How severe is CVE-2025-71409?: High severity. CVSS v3 base score is 7.1 out of 10.