The vulnerability CVE-2025-71409 affects the ATN-B1 CPDLC product and involves a lack of authentication in Very High Frequency Data Link messages. This weakness enables an attacker operating a rogue ground station to inject CPDLC messages remotely via radio frequency. Such unauthorized message injection can cause pilots to receive unexpected or misleading clearances, increasing the risk of operational errors. The CVSS 4.0 score is 7.1, reflecting a high severity with network attack vector, high impact on integrity and availability, and low privileges required. No remediation level or patch information is provided, and no known exploits are reported in the wild.

The impact of this vulnerability is that attackers can remotely inject false CPDLC messages, potentially causing pilots to act on incorrect or misleading instructions. This could lead to confusion and operational safety risks in aviation communications. The integrity and availability of CPDLC communications are affected. There is no indication of confidentiality impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor vendor communications for updates. Until a fix is available, consider additional operational controls or monitoring to detect anomalous CPDLC messages if feasible.