Researchers at the University of California San Diego demonstrated a proof-of-concept attack showing that brief physical access to a Boeing 737 could allow an attacker to manipulate data exchanged between critical avionics systems. Using a custom hardware device connected to an unused maintenance interface in an electronics bay beneath the aircraft’s nose, the researchers were able to interfere with communications over the aircraft’s legacy ARINC 429 data buses. In testing with Boeing 737 components and flight software, they altered flight-plan information as well as data related to weight, balance, and temperature that can affect takeoff calculations.
The vulnerability stems in part from the design of ARINC 429, which predates modern cybersecurity practices and does not authenticate the origin of messages. The attack is not a remote hijacking scenario: it requires access to a secured area of the aircraft, specialized knowledge, and preparation. The researchers disclosed the issue to Boeing in 2020 and subsequently validated their findings in a Boeing laboratory. They emphasized that the research does not indicate an imminent threat to commercial aviation but highlights the need to treat short-duration physical access and legacy avionics interfaces as cybersecurity risks.
Why it matters: The research shows how legacy cyber-physical systems can implicitly trust data from connected components, creating risks that conventional network-security measures may not address. For aviation and other critical infrastructure, it reinforces the need to integrate physical security, maintenance access controls, and authentication of operational data into cybersecurity planning.
Source: Interesting Engineering
Author: Aamir Khollam
Published: August 13, 2026