brake

In August 2025, the world of rail security faced a shocking precedent.
CISA (the U.S. Cybersecurity Agency) officially confirmed the existence of CVE-2025-1727, a vulnerability in the emergency braking systems of freight trains.
Why Brakes Have Become the Achilles' Heel
The problem stems from the communication protocol between the head-of-the-line (HoT) and tail-of-the-line (EoT) cars. Instead of modern encryption, it uses the BCH checksum—a mathematical data integrity check developed back in the 1960s.
Imagine sending a secret code to a colleague, but using a postcard instead of a sealed envelope: anyone can read and change the contents. Technically, the exploit works like this: the devices communicate on a frequency of 457 MHz—a public band, like FM radio.

An attacker with an SDR radio (a software-defined device priced at $300-500) can:
intercept the signal between train cars;
decrypt the 16-bit checksum;
generate a fake braking command.
A real-world demonstration took place back in 2014. Researcher Eric Reiter, at the DEFCON conference (the world's largest annual summit of hackers and cybersecurity experts), demonstrated how he could stop a model train in 90 seconds by transmitting a fake signal from a laptop and a homemade antenna.

But it wasn't until 2025, after a series of incidents in Europe where a similar protocol was used to stop trains, that MITRE experts confirmed the vulnerability and assigned it a CVSS 8.1 rating—"high risk."
An attack on Deutsche Bahn (Germany) via VPN gateways resulted in an eight-hour outage of regional trains. Attackers exploited a vulnerability in the DNP3 protocol to spoof signaling commands.
Why the problem was ignored
The main reason is economics. There are 75,000 HoT/EoT devices in operation in North America. Replacing them with secure IEEE 802.16t equivalents will cost $7-10 billion, according to AAR estimates, and will take 5-7 years due to approvals and testing.
This is a classic conflict between security and operational continuity. Railroads operate by the principle "if it works, don't touch it." Replacing legacy systems requires not only financial costs but also temporary disruption to transportation companies.
For freight carriers, downtime means a loss of $2.6 million per hour.
CISA, in its May 2025 bulletin, writes that railroads have historically focused on physical security. Digital risks have remained secondary due to the assumed isolation of OT networks. Following the publication of the CISA report, concrete actions began:
temporary measures—installing interference filters on EoT antennas;
a phased transition to the FRED-II standard with AES encryption;
a grant program for small railroads to support modernization.
But the problem runs deeper. Vulnerability CVE-2025-1727 is just a symptom. The real problem lies in outdated standards that don't address modern cyber threats.