Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2025-1727 EUVD-2025-21087GHSA-q5w3-wqpr-96vw

End-of-Train and Head-of-Train Remote Linking Protocol Weak Authentication

Published Jul 10, 2025 · Updated Jul 11, 2025 · Assigned by icscert

Vendor: End-of-Train and Head-of-Train remote linking protocol Product: End-of-Train and Head-of-Train remote linking protocol

Description

The protocol used for remote linking over RF for End-of-Train and
Head-of-Train (also known as a FRED) relies on a BCH checksum for packet
creation. It is possible to create these EoT and HoT packets with a
software defined radio and issue brake control commands to the EoT
device, disrupting operations or potentially overwhelming the brake
systems.

Affected products

VendorProductAffectedFixed
End-of-Train and Head-of-Train remote linking protocol End-of-Train and Head-of-Train remote linking protocol All versions —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • spinfosecurity/Rail-OT-Protector ★ 1 · Aug 4, 2026

    Rail-OT-Protector (ROP) — free, open-source cybersecurity scanning tool for rail and transit OT/SCADA networks. PowerShell + Bash scanners for CVE-2025-1727, RailSafe legacy API, ICS protocol exposur…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References