This bulletin addresses a weak authentication vulnerability (CVE-2025-1727) affecting Siemens Mobility Trainguard End-of-Train (EOT) and Head-of-Train (HOT) devices. These devices communicate using the S-9152 Standard, and the protocol's lack of authentication could allow an attacker to inject malicious commands. This may lead to operational disruption or induced brake failure.

This vulnerability was highlighted in CISA Advisory ICSA-25-191-10. Given the protocol-level nature of this vulnerability and that no software fix is currently planned, Siemens Mobility cannot provide specific product-level countermeasures. Operators are encouraged to consult the CISA advisory for general security guidance.

On 2025-07-10, the Cybersecurity and Infrastructure Security Agency (CISA) published advisory ICSA-25-191-10, detailing a weak authentication vulnerability in the End-of-Train and Head-of-Train remote linking protocol. Siemens Mobility is identified as an affected vendor for devices utilizing this protocol.

The following Siemens Mobility products are affected:

• Trainguard EOT

• Trainguard HOT

The protocol used for remote linking over RF for End-of-Train and Head-of-Train (also known as a FRED) relies on a BCH checksum for packet creation. It is possible for an attacker to create these EoT and HoT packets using a software-defined radio and issue brake control commands to the EoT device. This could lead to disrupting operations or potentially overwhelming the brake systems.

This vulnerability has been assigned CVE-2025-1727. A CVSS v3 base score of 8.1 (HIGH) has been calculated with the vector string: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.

Successful exploitation of this vulnerability could allow an attacker to send their own brake control commands to the end-of-train device, causing a sudden stoppage of the train which may lead to a disruption of operations, or induce brake failure.

This vulnerability is not exploitable remotely over the internet. Exploitation requires adjacent network access (e.g., via radio frequency within range of the devices).

The Association of American Railroads (AAR) maintains the S-9152 protocol used by these devices. This is a protocol-level vulnerability, and currently, no software fix for existing devices is planned. The AAR is pursuing new equipment and protocols that should eventually replace traditional End-of-Train and Head-of-Train devices.

Given that the vulnerability lies within the AAR S-9152 standard and no software fix is currently planned for existing devices, Siemens Mobility cannot provide specific product-level countermeasures for this protocol-level issue.

The long-term solution for this vulnerability is the adoption of new equipment and protocols being pursued by the Association of American Railroads (AAR).

Operators should be aware of the nature of this vulnerability and the potential for disruption. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

For general industrial control system security best practices, operators are encouraged to consult relevant guidelines, including those provided by CISA.

[1] CISA Advisory ICSA-25-191-10: End-of-Train and Head-of-Train Remote Linking Protocol (Update A) https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-10