A major vulnerability in the End-of-Train (EoT) protocol, identified as CVE-2025-1727, allows attackers to send commands that can abruptly engage train brakes across North America. Discovered by Neil Smith in 2012, the issue involves weak authentication using a BCH checksum. The Association of American Railroads plans to replace over 75,000 EoT devices with a more secure protocol, expected to take 5-7 years and cost $7-10 billion. CISA has issued an advisory on the vulnerability.
