VULNpocalypse
MediumVulnerabilityMonitoring

TETRA radio authentication flaws: Midnight Blue says traffic can be injected

Midnight Blue says TETRA authentication does not protect message authenticity, CVE-2025-52944; TETRA operators should ask vendors about exposure.

Published
Exploitation
No, the source describes the researchers’ own practical demonstration and reports no in-the-wild exploitation.

What happened

Security research firm Midnight Blue says that authentication in the TETRA radio standard provides no authenticity guarantees for messages or traffic. According to Midnight Blue, this means malicious traffic can be injected into TETRA networks, and authentication does not prevent it. Midnight Blue says it first reported the issue in its TETRA:BURST research, made public in 2023. The issue was only assigned CVE-2025-52944 after the researchers built a practical demonstration to disprove vendor and system integrator claims that the attack was infeasible.

Midnight Blue makes these technical claims:

  • In non-class 3 networks, TETRA authentication only restricts registration on the network. It plays no role in protecting the authenticity or integrity of regular traffic or signalling (Midnight Blue).
  • Call setup messages carry a calling identity (SSI), but nothing in the message ties it to the real owner of that ISSI. Midnight Blue says anyone can inject traffic using an SSI registered on the cell (Midnight Blue).
  • Many base stations do not require re-authentication when a radio roams between cell towers, because this reduces load on the authentication centre. Midnight Blue says this enables a more powerful attack: an attacker can impersonate an SSI registered anywhere on the network and send a location update on its behalf. The original radio is deregistered without being notified (Midnight Blue).

Midnight Blue says the consequences are most serious where voice or data traffic has direct operational effects, such as security dispatching and SCADA WANs. The firm also notes that many critical infrastructure operators historically used TEA1 or no encryption at all. It describes TEA1 as backdoored (Midnight Blue).

The following points are not confirmed:

  • No independent outlet or official advisory has verified these findings in the provided sources.
  • No vendor response, patch or affected product list is given.
  • No in-the-wild exploitation is reported.

Am I affected?

According to Midnight Blue:

  • In TETRA networks that are not class 3, authentication does not protect regular traffic, so traffic can be injected by impersonating an SSI registered on the same cell.
  • If your infrastructure also skips re-authentication when radios roam between cells, Midnight Blue says an attacker can go further and take over the registration of a radio registered anywhere on the network.

Midnight Blue says the impact is greatest where traffic has direct operational consequences, such as dispatch or SCADA data links. Which specific vendors, products or deployments are affected is not confirmed.

What to do now

  1. Identify where your organisation relies on TETRA for voice or data with operational consequences, such as dispatch or SCADA links. These are the risk areas named by Midnight Blue.
  2. Ask your vendor or system integrator about CVE-2025-52944. Ask them to state whether your network is class 3 and whether re-authentication is skipped on cell roaming.
  3. Do not treat successful radio registration as proof that a given message came from that radio, as Midnight Blue explains.
  4. Check the NVD record for vendor guidance or fixes. None is given in the current sources.

Sources