A critical vulnerability in railway communication systems, specifically affecting the End-of-Train and Head-of-Train remote linking protocols, has been identified. This vulnerability allows attackers to control train brakes remotely, potentially causing sudden train stoppages or brake failures. The flaw stems from weak BCH checksum authentication, which can be exploited using software-defined radio to forge brake control packets. Mitigation efforts include network isolation, firewall protection, and secure VPN access.
Source: https://cybersecuritynews.com/hackers-control-train-brakes/
TPRM report: https://scoringcyber.rankiteo.com/company/hitachirail
"id": "hit811071525",
"linkid": "hitachirail",
"type": "Vulnerability",
"date": "7/2025",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"{'affected_entities': [{'industry': 'Transportation',
'location': 'United States',
'name': ['Hitachi Rail STS USA', 'Wabtec', 'Siemens'],
'type': 'Manufacturer'}],
'attack_vector': 'Radio Frequency (RF) communications',
'description': 'A severe vulnerability in railway communication systems '
'allows attackers to control train brakes remotely.',
'impact': {'operational_impact': ['sudden train stoppages',
'brake system failures'],
'systems_affected': 'End-of-Train and Head-of-Train remote linking '
'protocols'},
'initial_access_broker': {'entry_point': 'adjacent network access'},
'motivation': 'Disruption of operations, brake system failures',
'post_incident_analysis': {'corrective_actions': ['network isolation',
'firewall protection',
'secure VPN access',
'manufacturer coordination '
'for protocol updates'],
'root_causes': 'weak BCH checksum authentication'},
'recommendations': ['ensure control system devices are not accessible from '
'the internet',
'implement proper network segmentation with firewalls',
'use secure remote access methods like Virtual Private '
'Networks (VPNs)'],
'references': [{'source': 'CISA'}],
'response': {'containment_measures': ['network isolation',
'firewall protection',
'secure VPN access'],
'remediation_measures': ['manufacturer coordination for protocol '
'updates']},
'title': 'Critical Vulnerability in Railway Communication Systems',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2025-1727'}