VulnerabilityDeferred

CVE-2025-71411

This type of attack can be carried out remotely over radio frequency.

MEDIUM 6.0EPSS 0.20%

Does this matter?

Lower severity and a low EPSS score (0.20%). Track it; it rarely justifies an emergency change on its own.

Description

Broadcast control frames can disconnect multiple aircraft simultaneously leading to delayed clearances and air traffic controller overload. This type of attack can be carried out remotely over radio frequency.

CVSS 4.0: 6.0 MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.20% probability · 10th percentile
CISA KEV: Not listed
Weakness: CWE-770
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-219-01

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.