Multiple flaws found in TETRA radio systems, exposing law enforcement, military, critical infrastructure communications

Security consulting firm Midnight Blue on Thursday disclosed nine zero-day vulnerabilities in the Terrestrial Trunked Radio (TETRA) standard and in equipment used worldwide by law enforcement, military, and critical infrastructure operators. The findings build on the firm’s 2023 disclosure of the TETRA:BURST vulnerabilities. Three of the newly identified flaws affect the End-to-End Encryption (E2EE) layer, an additional security layer built on top of the Air Interface Encryption (AIE) layer, where the earlier vulnerabilities were found. Midnight Blue also uncovered six other previously unknown vulnerabilities affecting the TETRA standard and compatible devices.

The E2EE vulnerabilities were discovered by reverse-engineering a Sepura radio firmware implementation and consist of a variant featuring a weakened algorithm (CVE-2025-52941), reducing the initial 128-bit key to 56 bits, as well as vulnerabilities that allow an attacker to either inject and replay arbitrary voice traffic (CVE-2025-52940) or replay text messages (CVE-2025-52942) at will. Organizations operating Sepura Gen 3 devices, such as the SC20 series, are most likely affected by these security flaws.

E2EE is typically used to provide sensitive TETRA users, such as special forces, covert units, and intelligence agencies, with additional protection.

Using open-source intelligence (OSINT), Midnight Blue determined that TETRA E2EE solutions are deployed by law enforcement and military agencies in multiple regions, including Europe (the U.K., Germany, Netherlands, Belgium, Norway, Denmark, Sweden, Finland, Spain, Estonia, Poland, Romania), Latin America (Mexico, Argentina, Brazil, Peru), the Middle East (Saudi Arabia, United Arab Emirates, Jordan), and Asia (India, Vietnam, Malaysia, Hong Kong).

Midnight Blue detailed three security loopholes, including CVE-2025-52945, which is a critical vulnerability caused by defective file management restrictions, which could allow unauthorized code execution if an attacker has physical access. The CVE-2025-8458 is a critical vulnerability stemming from insufficient key entropy for SD card encryption, enabling unauthorized code execution when physical access is obtained, and the MBPH-2025-003 is a medium-severity key exfiltration vulnerability that can lead to the loss of confidentiality and integrity of TETRA traffic, potentially resulting in code execution.

“While we assessed an E2EE implementation by Sepura and cannot generalize these results to other vendors we haven’t looked at yet, other implementations are likely also affected to at least some extent,” said Carlo Meijer, founding partner at Midnight Blue.

“The weakened algorithm is particularly worrying,” Meijer continued, “because it is vendor-agnostic and for users of this variant, any attacker with modest computing resources can break the E2EE layer and reduce security of the most sensitive TETRA communications to its Air Interface Encryption – which we have shown to suffer from critical flaws as well.”

“Once again, the fact that these vulnerabilities have gone unreported for so long is due to the violation of Kerckhoffs’ Principle, which states that a cryptosystem should be secure even if an adversary knows how it works,” said Jos Wetzels, founding partner at Midnight Blue.

Wetzels continued, “The E2EE replay and injection vulnerabilities are conceptually simple and should be immediately apparent to anyone reviewing design specifications. However, since these specifications have been kept secret, no public assessments could take place without a laborious reverse-engineering process, resulting in unnecessary risks. And while the weakened algorithm is there due to export controls, it is unclear to us how aware most end users receiving it are of the fact that their most sensitive TETRA communications are protected by a completely inadequate level of security.”

First published in 1995 by the European Telecommunications Standards Institute (ETSI), TETRA is one of the most widely used professional mobile radio standards – especially for law enforcement – and has been in continuous use for decades for voice, data, and machine-to-machine communications.

The TETRA End-to-End Encryption (E2EE) design, first introduced in 2001, is based on recommendations from The Critical Communications Association (TCCA) Security & Fraud Prevention Group (SFPG) and implemented by vendors including Sepura, Sectra, Airbus, Leonardo, Hytera, and Motorola. Like the original Air Interface Encryption (AIE) algorithms, the E2EE specifications have been distributed only under strict non-disclosure agreements to a small number of parties, blocking independent public security reviews. 

While the AIE algorithms were eventually released by ETSI in response to public pressure after Midnight Blue’s 2023 disclosures, the E2EE specifications have remained secret until now.

Midnight Blue assesses that these vulnerabilities could allow an attacker to execute code on a Sepura Gen 3 device. Exploiting CVE-2025-8458 enables persistent code execution via access to the device’s SD card, while CVE-2025-52945 can be abused even more easily, requiring only brief access to the PEI connector. Once code execution is achieved, attackers could exfiltrate TETRA key materials (MBPH-2025-003) or implant a persistent backdoor in the radio firmware, compromising the confidentiality and integrity of TETRA communications. 

The research added that MBPH-2025-003 specifically allows the extraction of all TETRA and TETRA E2EE key materials except for the device-specific key K.

Midnight Blue follows the Dutch NCSC’s Coordinated Vulnerability Disclosure (CVD) guidelines, which require a six-month embargo period for hardware and embedded systems vulnerabilities. At the time of reporting, an advisory was submitted to the NCSC, which then distributed it further. To protect asset owners and stakeholders from unnecessary exposure to risk, deep technical details are withheld at the time of initial publication.

The vulnerabilities were originally identified and reported to the client in June 2023. In February 2025, they were reported to NCSC-NL, which is responsible for notifying the vendor. By June 2025, the vendor provided a response outlining its remediation timeline. In July 2025, Midnight Blue held a call with Sepura to discuss the device vulnerabilities. This month, the company published high-level descriptions of the vulnerabilities, while a patch is scheduled for release in the third quarter of this year.

Sepura plans to release remediation patches for CVE-2025-52945 and CVE-2025-8458 in the third quarter of 2025, with updates expected for SC6.0, SC5.3, and SC4.3 devices. A detailed advisory has been shared with relevant stakeholders via the Dutch National Cyber Security Centre (NCSC).

Until the patches are available and deployed, organizations should implement enhanced TETRA key management practices, including strict key rotation policies and clear procedures for handling lost devices. The MBPH-2025-003 key exfiltration vulnerability cannot be patched due to architectural limitations. However, it requires a separate code execution vulnerability to be exploited before any keys can be recovered and exfiltrated.

Apart from the three E2EE vulnerabilities, Midnight Blue detailed new vulnerabilities in the TETRA standard and devices. These include an insufficient fix (MBPH-2025-001) recommended by ETSI against a keystream recovery vulnerability (CVE-2022-24401) previously discovered by Midnight Blue, the ability to inject arbitrary messages on TETRA networks (CVE-2025-52944), and risks with multi-cipher network setups (CVE-2025-52943).

Meijer detailed that these issues exist at the level of the TETRA standard itself and, as such, are vendor-agnostic. “The insufficient keystream recovery fix, incorporated as a standards revision by ETSI, essentially means that asset owners who have gone to great lengths to mitigate the original vulnerability are still at risk of exploitation with limited additional attacker effort.”

He highlighted “the ability to inject arbitrary messages is something which we observed as a theoretical possibility in earlier research, but which both ETSI and vendors consistently downplayed as practically infeasible. We went out and set up a realistic lab setup and demonstrated the feasibility beyond doubt, the impact of which is particularly serious in SCADA WAN networks carried over TETRA, where message injection can have serious disruptive effects against electric and water utilities, oil & gas, and railways.”

In addition, several serious vulnerabilities (CVE-2025-52945, MBPH-2025-002, MBPH-2025-003) were discovered in Sepura’s Generation 3 radios (such as the SC20), allowing for achieving full privilege code execution and the ability to persistently implant the device and extract secret key material after only seconds of physical access.

“These vulnerabilities are illustrative of what we found to be an inadequate security posture for a radio used in such sensitive contexts, lagging seriously behind even outdated consumer smartphones,” said Wouter Bokslag, founding partner at Midnight Blue. “This subpar security posture is not unique to Sepura, however, and is a persistent problem in the entire TETRA ecosystem.”

In June 2023, Midnight Blue disclosed five zero-day vulnerabilities in the Terrestrial Trunked Radio (TETRA) standard, including two rated critical, impacting global law enforcement agencies, military, critical infrastructure, and industrial asset owners in the power, oil and gas, water, and transport sectors and beyond. The data identified that, depending on infrastructure and device configurations, these vulnerabilities allow for real-time decryption, harvest-now-decrypt-later attacks, message injection, user deanonymization, or session key pinning.

Anna Ribeiro

Industrial Cyber News Editor. Anna Ribeiro is a freelance journalist with over 14 years of experience in the areas of security, data storage, virtualization and IoT.