Vulnerability Details CVE-2025-25735
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 14.4%
CVSS Severity
CVSS v3 Score 7.5
References
- https://cwe.mitre.org/data/definitions/1233.html
- https://phrack.org/issues/72/16_md
- https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
- https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf
- https://www.kapsch.net/en
- https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en
Products affected by CVE-2025-25735
-
cpe:2.3:h:kapsch:ris-9160:-
-
cpe:2.3:h:kapsch:ris-9260:-
-
cpe:2.3:o:kapsch:ris-9160_firmware:3.2.0.829.23
-
cpe:2.3:o:kapsch:ris-9160_firmware:3.8.0.1119.42
-
cpe:2.3:o:kapsch:ris-9160_firmware:4.6.0.1211.28
-
cpe:2.3:o:kapsch:ris-9260_firmware:3.2.0.829.23
-
cpe:2.3:o:kapsch:ris-9260_firmware:3.8.0.1119.42
-
cpe:2.3:o:kapsch:ris-9260_firmware:4.6.0.1211.28