CISA Advisory ICSA-26-219-01: ATN-B1 CPDLC Vulnerabilities (CVE-2025-71409/10/11/12/13)

Vulnerability Overview Vulnerability Name: CPDLC over ATN-B1 Vulnerabilities Publication Date: August 7, 2026 Alert Code: ICSA-26-219-01 Related Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Impact Scope Affected Versions: ATN-B1 CPDLC vers:all CVE IDs: CVE-2025-71409, CVE-2025-71410, CVE-2025-71411, CVE-2025-71412, CVE-2025-71413 CVSS Score: v3.7.1 Standard: Advisory Circular 90-117 Data Link Communications Device: CPDLC over ATN-B1 Vulnerabilities Vulnerability Types: - Lack of authentication for critical functions - Unrestricted or unthrottled resource allocation - Inadequate checks for anomalies or exceptions Remediation Background: - Critical Infrastructure Sector: Transportation Systems - Deploying Countries/Regions: Global - Company Headquarters Location: Global Vulnerability Details: - CVE-2025-71409: Lack of authentication for critical functions - CVE-2025-71410: Unrestricted or unthrottled resource allocation - CVE-2025-71411: Inadequate checks for anomalies or exceptions - CVE-2025-71412: Lack of authentication for critical functions - CVE-2025-71413: Unrestricted or unthrottled resource allocation Acknowledgements: - Martin Strohmeier of Armasuisse reported these vulnerabilities to CISA. Revision History: - Initial Publication Date: 2026-08-07 - Revision: 1 - Summary: Initial Release Tags Sector: Transportation Systems Sector Topics: Industrial Control System Vulnerabilities, Industrial Control Systems Related Links Related Advisories: - Johnson Controls Inc. TL280 - ABB Ability Zenon - Acrisure KARR BT and DR-100 - Schneider Electric IGSS Legal Notice and Terms of Use This product is subject to this notice and the Privacy and Use Policy. Feedback Please share your thoughts. We have recently updated our anonymous product survey and welcome your feedback. Footer CISA Central: 1-844-Say-CISA, contact@cisa.dhs.gov CISA.gov: Official website of the U.S. Department of Homeland Security Summary This webpage details multiple vulnerabilities in CPDLC over ATN-B1, including lack of authentication, unrestricted resource allocation, and inadequate checks for anomalies. These vulnerabilities affect transportation systems globally and provide detailed CVE identifiers and CVSS scores. Remediation steps include updating devices and adhering to relevant standards. The page also provides related links and legal notices.

Goal Reached Thanks to every supporter — we hit 100%!

CISA Advisory ICSA-26-219-01: ATN-B1 CPDLC Vulnerabilities (CVE-2025-71409/10/11/12/13)