{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "cveId": "CVE-2025-1727", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-02-26T20:19:11.460Z", "datePublished": "2025-07-10T22:59:34.802Z", "dateUpdated": "2025-07-11T14:06:28.251Z" }, "containers": { "cna": { "affected": [ { "defaultStatus": "unaffected", "product": "End-of-Train and Head-of-Train remote linking protocol", "vendor": "End-of-Train and Head-of-Train remote linking protocol", "versions": [ { "status": "affected", "version": "All versions" } ] } ], "credits": [ { "lang": "en", "type": "finder", "value": "Neil Smith and Eric Reuter reported this vulnerability to CISA." } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "The protocol used for remote linking over RF for End-of-Train and \nHead-of-Train (also known as a FRED) relies on a BCH checksum for packet\n creation. It is possible to create these EoT and HoT packets with a \nsoftware defined radio and issue brake control commands to the EoT \ndevice, disrupting operations or potentially overwhelming the brake \nsystems." } ], "value": "The protocol used for remote linking over RF for End-of-Train and \nHead-of-Train (also known as a FRED) relies on a BCH checksum for packet\n creation. It is possible to create these EoT and HoT packets with a \nsoftware defined radio and issue brake control commands to the EoT \ndevice, disrupting operations or potentially overwhelming the brake \nsystems." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] }, { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 7.2, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-1390", "description": "CWE-1390", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-07-10T22:59:34.802Z" }, "references": [ { "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-10" } ], "source": { "advisory": "ICSA-25-191-10", "discovery": "EXTERNAL" }, "title": "End-of-Train and Head-of-Train Remote Linking Protocol Weak Authentication", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

The Association of American Railroads (AAR) is pursuing new equipment\n and protocols which should replace traditional End-of-Train and \nHead-of-Train devices. The standards committees involved in these \nupdates are aware of the vulnerability and are investigating mitigating \nsolutions.

\n

The AAR Railroad Electronics Standards Committee (RESC) maintains \nthis protocol which is used by multiple manufacturers across the \nindustry, including Hitachi Rail STS USA, Wabtec, Siemens, and others. \nUsers of EoT/HoT devices are recommended to contact their own device \nmanufacturers with questions.

" } ], "value": "The Association of American Railroads (AAR) is pursuing new equipment\n and protocols which should replace traditional End-of-Train and \nHead-of-Train devices. The standards committees involved in these \nupdates are aware of the vulnerability and are investigating mitigating \nsolutions.\n\n\nThe AAR Railroad Electronics Standards Committee (RESC) maintains \nthis protocol which is used by multiple manufacturers across the \nindustry, including Hitachi Rail STS USA, Wabtec, Siemens, and others. \nUsers of EoT/HoT devices are recommended to contact their own device \nmanufacturers with questions." } ], "x_generator": { "engine": "Vulnogram 0.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2025-07-11T14:06:22.369634Z", "id": "CVE-2025-1727", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-11T14:06:28.251Z" } } ] } }