The vulnerability arises from a lack of authentication for Very High Frequency (VHF) Data Link messages in the CPDLC protocol stack, enabling a rogue ground station to inject CPDLC commands. These injected messages can convey misleading or unexpected clearances, potentially confusing pilots or leading to unsafe flight conditions. The weakness is classified as CWE-306, reflecting the risks associated with unauthenticated data transmission.

Affected systems include installations using the ATN-B1 CPDLC protocol stack. As specific version information is not disclosed, any implementation of the CPDLC stack may be impacted; users should verify the build in use.

The CVSS score of 7.1 places the vulnerability in the high severity range, yet no EPSS score is available and it is not listed in CISA’s KEV catalog. The attack vector is remote via radio frequency, requiring a physical VHF link; laboratory studies suggest exploitation demands specific conditions, making real-world attacks unlikely but not impossible. Consequently, the overall risk is moderate, prompting operators to remain alert to potential unauthorized VHF activity and to review incident response protocols.