VulnerabilityModified
CVE-2025-25734
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot…
MEDIUM 6.8EPSS 0.35%
Does this matter?
Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.
Description
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.35% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-1233
- Affected
- kapsch/ris-9160 firmware · kapsch/ris-9260 firmware
- Source
- cve@mitre.org
References
- https://cwe.mitre.org/data/definitions/1233.htmlTechnical Description
- https://phrack.org/issues/72/16_mdExploit, Third Party Advisory
- https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdfBroken Link
- https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdfProduct
- https://www.kapsch.net/enProduct
- https://www.kapsch.net/en/press/releases/ktc-20200813-pr-enProduct
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.