OTPulse

CPDLC over ATN-B1 Vulnerabilities

MonitorCVSS 7.1ICS-CERT ICSA-26-219-01Aug 7, 2026
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityHigh
User InteractionNone needed
Summary

ATN-B1 CPDLC (Controller-Pilot Data Link Communications) relies on legacy clear-text, unauthenticated VHF radio frequency links. These characteristics allow unauthorized message injection, denial-of-service attacks, and forced session resets. While not creating an unsafe aircraft condition per se, these vulnerabilities can degrade operational safety margins by increasing pilot workload, delaying critical instructions, and reducing situational awareness. The vulnerabilities require very specific conditions and high attack complexity to exploit, and no known public exploitation has been reported.

What this means
What could happen
An attacker on the radio frequency link could inject unauthorized messages into CPDLC communications, reset pilot-controller sessions, or cause denial-of-service conditions that delay safety-critical instructions and increase pilot workload during critical flight phases.
Who's at risk
This affects all civil aviation operators using ATN-B1 CPDLC for pilot-controller data link communications, including commercial airlines, business aviation, and air traffic control facilities that rely on CPDLC for clearance delivery and flight information exchange.
How it could be exploited
An attacker with access to the VHF radio frequency band and knowledge of the CPDLC protocol could craft and inject spoofed messages that appear to originate from air traffic control, or transmit jamming/reset signals to disrupt the data link between pilots and controllers. This requires proximity to the aircraft and detailed understanding of the protocol structure.
Prerequisites
  • Access to VHF radio frequency band in the aircraft's operational area
  • Knowledge of CPDLC protocol message format and timing
  • Ability to transmit on the same frequency as active CPDLC sessions
  • High attack complexity; specific environmental and timing conditions required
remotely exploitableno authentication requiredhigh attack complexityaffects safety systems
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (1)
ProductAffected VersionsFix Status
Advisory Circular 90-117 Data Link Communications ATN-B1 CPDLCAll versionsNo fix yet
Remediation & Mitigation
0/3
Do now
0/1
HARDENINGImplement procedural controls: crews should verify critical clearances received via CPDLC through voice confirmation with ATC before executing safety-critical maneuvers
Schedule — requires maintenance window
0/2

Patching may require device reboot — plan for process interruption

HARDENINGEnhance monitoring: air traffic service providers should monitor for unexpected CPDLC session resets or anomalous message patterns and correlate with radio link quality
HARDENINGReport suspected incidents: establish procedures to immediately report suspected malicious CPDLC activity to CISA and your regional aviation authority
View full CISA ICS-CERT advisory
API: /api/v1/advisories/c9194ef0-74db-44aa-afa7-878b5d358ab2

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

CPDLC over ATN-B1 Vulnerabilities | CVSS 7.1 - OTPulse