tl:dr;

• Contrary to popular belief among vendors, system integrators, and asset owners: network authentication in TETRA mission-critical radio networks does not provide authenticity & integrity guarantees at the individual message level.
• To make matters worse: base stations don't require a re-authentication whenever a radio is roaming from one cell tower to the next.
• This allows for traffic injection attacks: both voice and data. The latter is particularly worrying for SCADA WAN scenarios or where voice & alarming functionality can disrupt operations at such as at airports, harbors, railway operators, and civil defense siren systems.
• The 2026 attack on Taiwan High Speed Rail's TETRA network, leading to the emergency stop of several trains, shows a mild example of possible impact: https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1