This vulnerability (CVE-2025-71409) affects the ATN-B1 CPDLC system by lacking authentication mechanisms for Very High Frequency Data Link messages. As a result, an attacker operating a rogue ground station can inject unauthorized CPDLC messages remotely via radio frequency. This can lead to pilots receiving unexpected or misleading clearances, increasing the risk of confusion during flight operations. The CVSS 4.0 score is 7.1, reflecting network attack vector, high impact on integrity and availability, and low privileges required. No vendor advisory or patch information is currently available.

The vulnerability allows remote attackers to inject false CPDLC messages, which can cause pilots to receive misleading or unexpected clearances. This could disrupt normal flight operations and potentially compromise flight safety by confusing pilots. The impact affects message integrity and availability but does not involve confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, operators should consider additional monitoring and verification procedures for CPDLC messages to detect anomalous or unauthorized communications. No official remediation or temporary fix has been published.