Railroad Vulnerability Will Let Hackers Attack Trains

Uploaded on 2025-07-15 in NEWS-Cybersecurity News, FREE TO VIEW, BUSINESS-Services-Transport & Travel

A newly disclosed vulnerability in train braking systems could let hackers remotely stop trains with relatively simple and inexpensive hardware, potentially causing derailments, according to the US Cybersecurity & Infrastructure Security Agency (CISA).

The high-severity vulnerability, tracked as CVE-2025-1727, involves weak authentication in the protocol used to send what are known as end-of-train and head-of-train packets, radio signals that command a rail vehicle’s end-of-train device to stop the vehicle.

“Successful exploitation of this vulnerability could allow an attacker to send their own brake control commands to the end-of-train device, causing a sudden stoppage of the train which may lead to a disruption of operations, or induce brake failure,” CISA said in an advisory that the vulnerability was relatively simple to exploit.

The Association of American Railroads, an industry trade group that manages a committee responsible for maintaining the flawed protocol, is developing new systems to replace the vulnerable ones, according to the CISA advisory. However, these new systems won’t be ready until 2027 at the earliest, according to Neil Smith, one of two researchers who independently discovered the vulnerability and reported it to CISA. Indeed, the vulnerabilty was first reported on at the DEF CON hacker conference in 2018 when Eric Reuter, the other researcher credited with its discovery first talked about it

Today, the vulnerability is recognised as potentially represents one of the most serious cyber threats to rail infrastructure ever discovered. By sending fraudulent brake signals to a train, hackers could derail or damage it, endangering passengers and cargo, and disrupt the US’s complex freight and passenger rail system.

The US has around 140,000 miles of track which transport over a billion tons of goods annually, and railroads are also vital to military logistics. Hackers believed to be working for the Russian government have hit rail lin Ukraine and Poland, which is a key hub for Western aid bound for Ukraine.

The US Transportation Security Administration, the federal agency responsible for helping to protect the rail industry from cyber threats and natural disasters, issued its first cyber regulations in 2022. Since then, the TSA has tried to work with the industry to improve digital defences, but so far without success.

Image: Ideogram

You Might Also Read:

Poland’s Train Network Disrupted:

If you like this website and use the comprehensive 8,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.