CVE-2025-25736

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-25736
Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cwe.mitre.org/data/definitions/306.html Technical Description
https://phrack.org/issues/72/16_md Exploit Third Party Advisory
https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf Broken Link
https://www.kapsch.net/en Product
https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en Product
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:kapsch:ris-9160_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:4.6.0.1211.28:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9160:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:o:kapsch:ris-9260_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:4.6.0.1211.28:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9260:-:*:*:*:*:*:*:*
History

22 Oct 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 6.8

16 Sep 2025, 19:27

Type Values Removed Values Added
References () https://cwe.mitre.org/data/definitions/306.html - () https://cwe.mitre.org/data/definitions/306.html - Technical Description
References () https://phrack.org/issues/72/16_md - () https://phrack.org/issues/72/16_md - Exploit, Third Party Advisory
References () https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf - () https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf - Broken Link
References () https://www.kapsch.net/en - () https://www.kapsch.net/en - Product
References () https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en - () https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en - Product
CPE cpe:2.3:o:kapsch:ris-9160_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:4.6.0.1211.28:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9160:-:*:*:*:*:*:*:*
cpe:2.3:h:kapsch:ris-9260:-:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9160_firmware:3.2.0.829.23:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:3.8.0.1119.42:*:*:*:*:*:*:*
cpe:2.3:o:kapsch:ris-9260_firmware:4.6.0.1211.28:*:*:*:*:*:*:*
First Time Kapsch ris-9160 Firmware
Kapsch ris-9260 Firmware
Kapsch ris-9260
Kapsch ris-9160
Kapsch

27 Aug 2025, 14:15

Type Values Removed Values Added
CWE CWE-306
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
Summary
  • (es) Se descubrió que Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42 y v4.6.0.1211.28 contienen Android Debug Bridge (ADB) preinstalado (/mnt/c3platpersistent/opt/platform-tools/adb) y habilitado de manera predeterminada, lo que permite el acceso de shell root no autenticado al módem celular a través del usuario "kapsch" predeterminado.

26 Aug 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-26 15:15

Updated : 2025-10-22 15:15

NVD link : CVE-2025-25736

Mitre link : CVE-2025-25736

CVE.ORG link : CVE-2025-25736

JSON object : View

Products Affected

kapsch

  • ris-9160_firmware
  • ris-9260_firmware
  • ris-9160
  • ris-9260
CWE
CWE-306

Missing Authentication for Critical Function