CVE-2025-25733

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-25733
Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of the device.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 2.5

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://cwe.mitre.org/data/definitions/1233.html Technical Description
https://phrack.org/issues/72/16_md Exploit Third Party Advisory
https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf Broken Link
https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf Product
https://www.kapsch.net/en Product
https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en Product
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:kapsch:ris-9160_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:4.6.0.1211.28:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9160:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:kapsch:ris-9260_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:4.6.0.1211.28:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9260:-:*:*:*:*:*:*:*
History

22 Oct 2025, 15:15

Type Values Removed Values Added
CWE CWE-284 CWE-1233
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 3.5

18 Sep 2025, 15:31

Type Values Removed Values Added
References () https://cwe.mitre.org/data/definitions/1233.html - () https://cwe.mitre.org/data/definitions/1233.html - Technical Description
References () https://phrack.org/issues/72/16_md - () https://phrack.org/issues/72/16_md - Exploit, Third Party Advisory
References () https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf - () https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf - Broken Link
References () https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf - () https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf - Product
References () https://www.kapsch.net/en - () https://www.kapsch.net/en - Product
References () https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en - () https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en - Product
First Time Kapsch ris-9160 Firmware
Kapsch ris-9260 Firmware
Kapsch ris-9260
Kapsch ris-9160
Kapsch
CPE cpe:2.3:o:kapsch:ris-9160_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:4.6.0.1211.28:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9160:-:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9260:-:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:4.6.0.1211.28:*:*:*:*:*:*:*

29 Aug 2025, 16:22

Type Values Removed Values Added
Summary
  • (es) El control de acceso incorrecto en SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, y v4.6.0.1211.28 permite que atacantes físicamente próximos modifiquen arbitrariamente las regiones flash SPI, lo que lleva a una degradación de la postura de seguridad del dispositivo.

26 Aug 2025, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CWE CWE-284

26 Aug 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-26 15:15

Updated : 2025-10-22 15:15

NVD link : CVE-2025-25733

Mitre link : CVE-2025-25733

CVE.ORG link : CVE-2025-25733

JSON object : View

Products Affected

kapsch

  • ris-9160_firmware
  • ris-9260_firmware
  • ris-9160
  • ris-9260
CWE
CWE-1233

Security-Sensitive Hardware Controls with Missing Lock Bit Protection