No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.
Credit: Neil Smith, Eric Reuter
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-1727 | CWE-1390 Weak Authentication | 8.1 High |
The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and issue brake control commands to the EoT device, disrupting operations or potentially overwhelming the brake systems. Mitigation: The Association of American Railroads (AAR) is pursuing new equipment and protocols which should replace traditional End-of-Train and Head-of-Train devices. The standards committees involved in these updates are aware of the vulnerability and are investigatin… Mitigation: The AAR Railroad Electronics Standards Committee (RESC) maintains this protocol which is used by multiple manufacturers across the industry. Mitigation: Known affected vendors are: Affected, fixed & timelineAffected:
Mitigation: Wabtec Mitigation: Siemens Mitigation: DPS Electronics Mitigation: Users of EoT/HoT devices are recommended to contact their own device manufacturers with questions. Mitigation: Wabtec directs users to visit their cybersecurity page for additional information. Mitigation: Siemens advises users of Trainguard devices to reference the associated security bulletin. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-1727 | 8.1 High | End-of-Train and Head-of-Train remote linking protocol End-of-Train and Head-of-Train remote linking protocol The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation… |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.