Researchers Find Five Flaws in the Radio System Pilots and Air Traffic Controllers Use to Text Each Other

Key points

• CISA disclosed five vulnerabilities on 20 November 2025 in CPDLC over ATN-B1, the text-based system pilots and controllers use instead of voice radio.
• The flaws are tracked as CVE-2025-71409 through CVE-2025-71413, with the two most serious rated 7.1 out of 10.
• An attacker with a rogue radio transmitter could inject fake clearances, spoof emergency messages, or knock aircraft off the data link entirely.
• No patch is available, and CISA says the affected standard covers all versions worldwide.
• Attack complexity is rated high and no exploitation in the wild has been reported.

Air traffic control is not just voice on a crackly radio anymore. For decades, pilots and controllers have also swapped short text messages over a system called CPDLC, short for Controller Pilot Data Link Communications. Think of it as a pager network for the sky, used to send routine clearances so the voice channel stays clear for urgent traffic.

On 20 November 2025, the US Cybersecurity and Infrastructure Security Agency published an advisory saying that pager network has five security holes.

What did researchers actually find?

Five separate vulnerabilities in the CPDLC protocol as it runs over ATN-B1, the older of two network standards used worldwide. The radio link carrying these messages is sent in the clear, with no authentication, meaning nothing in the protocol checks that a message really came from a legitimate ground station or aircraft.

That single design choice, made decades ago when radio spectrum was assumed to be a closed club, is the root of all five bugs.

Here is how CISA describes them.

None of these let an attacker fly the plane. What they do is muddy the picture: forcing crews back to voice radio, inflating controller workload, and slipping misleading text into a channel humans are trained to trust.

Should airline passengers be worried?

Not in the near term. CISA is explicit that the flaws are, in its words, exploitable in a lab environment but require very specific conditions and are unlikely to be exploited outside one. No attacks in the wild have been reported.

To pull any of this off, someone would need a suitable VHF transmitter, physical proximity to the target aircraft or sector, and detailed knowledge of the ATN-B1 protocol stack. That is not a casual hobbyist setup. It is closer to the capability profile of a state signals-intelligence unit, and I would put only medium confidence on even that, given the operational risk of transmitting on a monitored aviation band.

Pilots and controllers also have a well-drilled fallback: if the text link misbehaves, they pick up the voice radio. Safety margins shrink, but the aircraft does not.

Why is there no patch?

Because there is nothing to patch in the usual sense. CPDLC over ATN-B1 is a standard, defined in the FAA's Advisory Circular 90-117, not a piece of software one vendor ships. Fixing it means changing the protocol itself, agreeing that change across every civil aviation authority that uses it, and then refitting ground stations and avionics worldwide.

CISA lists remediations as "None available" for all five CVEs. The longer-term answer is ATN-B2 and newer link designs that build in authentication, but transition timelines in aviation are measured in years, not sprint cycles.

For now, the advisory asks operators to report suspected malicious radio activity through normal channels so incidents can be correlated.