Injection of false emergency or status messages over the CPDLC protocol can cause misallocation of resources, operational confusion and improper response actions by flight crews, traffic controllers and ground operations. The vulnerability represents a classic message‑injection flaw (CWE‑754) that enables an attacker to craft and transmit messages the system will treat as legitimate, potentially disrupting flight operations.

The affected product is ATN‑B1 CPDLC. No specific version information is provided; all versions of the ATN‑B1 CPDLC stack that process emergency and status messages may be impacted.

The CVSS score of 7.1 indicates a high potential for serious operational impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the radio frequency channel that carries CPDLC traffic, but the CNA notes that the exploit requires very specific conditions, making real‑world exploitation unlikely outside a lab setting. If the conditions are met, the attacker could inject any emergency or status payload that the stack accepts without additional verification, leading to false alarms or missed real emergencies.