Researchers Find Five Flaws in the Radio System Pilots and Air Traffic Controllers Use to Text Each Other
CISA has published five CVEs against CPDLC, the digital messaging link between cockpits and control towers. There are no fixes, but exploitation needs lab-grade conditions.
Key points
- CISA disclosed five vulnerabilities in CPDLC over ATN-B1, the text-based system pilots and controllers use instead of voice radio.
- The flaws are tracked as CVE-2025-71409 through CVE-2025-71413, with the two most serious rated 7.1 out of 10.
- An attacker with a rogue radio transmitter could inject fake clearances or spoof emergency messages, knocking aircraft off the data link entirely.
- No patch is available, and CISA says the affected standard covers all versions worldwide.
- Attack complexity is rated high and no exploitation in the wild has been reported.
Air traffic control isn't just voice on a crackly radio. Pilots and controllers have long swapped short text messages over a system called CPDLC, short for Controller Pilot Data Link Communications. Think of it as a pager network for the sky, used to send routine clearances so the voice channel stays clear for urgent traffic.
CISA published an advisory saying that pager network has five security holes. We first covered CPDLC on 7 August 2026, so this isn't new territory for us, though the scope of what's now formally catalogued is wider than earlier research suggested.
What did researchers actually find?
Five separate vulnerabilities in the CPDLC protocol as it runs over ATN-B1, the older of two network standards used worldwide. The radio link carrying these messages is sent in the clear, with no authentication: nothing in the protocol checks that a message came from a legitimate ground station or aircraft.
That design choice, made when radio spectrum was assumed to be a closed club, is the root of all five bugs.
| CVE | What an attacker can do | CVSS |
|---|---|---|
| CVE-2025-71409 | Pose as a ground station and send fake clearances to a cockpit | 7.1 |
| CVE-2025-71410 | Send a disconnect frame that kicks a single aircraft off the data link | 5.3 |
| CVE-2025-71411 | Broadcast a control frame that disconnects multiple aircraft at once | 5.3 |
| CVE-2025-71412 | Inject a bogus emergency or status message | 7.1 |
| CVE-2025-71413 | Send malformed frames that force repeated session resets | not listed |
None of these let an attacker fly the plane. What they do is muddy the picture: forcing crews back to voice radio, inflating workload, slipping misleading text into a channel humans are trained to trust.
Should airline passengers be worried?
Not in the near term. CISA is explicit that the flaws are exploitable only in a lab environment, require very specific conditions, and are unlikely to be exploited outside one. No attacks in the wild have been reported.
Pulling any of this off needs a suitable VHF transmitter, physical proximity to the target aircraft or sector, and detailed knowledge of the ATN-B1 protocol stack. That's not a casual hobbyist setup. It's closer to the capability profile of a state signals-intelligence unit, and I'd put only medium confidence on even that, given the operational risk of transmitting on a monitored aviation band.
Pilots and controllers also have a well-drilled fallback: if the text link misbehaves, they pick up voice radio. Safety margins shrink, but the aircraft doesn't.
Why is there no patch?
Because there's nothing to patch in the usual sense. CPDLC over ATN-B1 is a standard, defined in FAA Advisory Circular 90-117, not a piece of software one vendor ships. Fixing it means changing the protocol, agreeing that change across every civil aviation authority that uses it, then refitting ground stations and avionics worldwide.
CISA lists remediations as "None available" for all five CVEs. The longer-term answer is ATN-B2 and newer link designs that build in authentication, but transition timelines in aviation run to years. For now, the advisory asks operators to report suspected malicious radio activity so incidents can be tracked.
