256/68 Wednesday, July 16, 2025
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a critical vulnerability, CVE-2025-1727, affecting End-of-Train (EoT) and Head-of-Train (HoT) systems—wireless communication platforms used to control train braking operations. The flaw, categorized under Weak Authentication (CWE-1390), could allow a malicious actor to remotely send spoofed brake commands to the rear of a train using radio equipment costing less than $500.
The EoT device, also known as the Flashing Rear End Device (FRED), transmits essential information such as brake line pressure to the HoT unit and displays a flashing light to mark the end of the train. It also receives emergency brake commands remotely. However, the radio communication protocol between the EoT and HoT lacks encryption and robust authentication, relying only on a BCH checksum. This weakness enables attackers to craft fake data packets using software-defined radio (SDR) and issue brake commands without needing privileged access.
Researchers Neil Smith and Eric Reuter first disclosed the issue in 2012, but no fixes have been implemented to date, despite multiple warnings to the American Association of Railroads (AAR) and the Federal Railroad Administration (FRA). The AAR previously downplayed the issue, claiming the system was “near end-of-life”—a claim contradicted by its ongoing use in both freight and passenger trains. Under mounting pressure, plans are now underway to transition from the legacy protocol to the IEEE 802.16t standard by 2027. While CISA has not yet found evidence of active exploitation, it warns that this vulnerability represents a nation-level security risk if leveraged for disruption or potential derailment of trains.
