CVE-2025-25736

Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/306.html	Technical Description
https://phrack.org/issues/72/16_md	Exploit Third Party Advisory
https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf	Broken Link
https://www.kapsch.net/en	Product
https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en	Product

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:kapsch:ris-9160_firmware:3.2.0.829.23:::::::*
	cpe:2.3:o:kapsch:ris-9160_firmware:3.8.0.1119.42:::::::*
	cpe:2.3:o:kapsch:ris-9160_firmware:4.6.0.1211.28:::::::*

cpe:2.3:h:kapsch:ris-9160:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

OR	cpe:2.3:o:kapsch:ris-9260_firmware:3.2.0.829.23:::::::*
	cpe:2.3:o:kapsch:ris-9260_firmware:3.8.0.1119.42:::::::*
	cpe:2.3:o:kapsch:ris-9260_firmware:4.6.0.1211.28:::::::*

cpe:2.3:h:kapsch:ris-9260:-:*:*:*:*:*:*:*

History

16 Sep 2025, 19:27

Type	Values Removed	Values Added
CPE		cpe:2.3:o:kapsch:ris-9160_firmware:3.8.0.1119.42:::::::* cpe:2.3:o:kapsch:ris-9160_firmware:4.6.0.1211.28:::::::* cpe:2.3:h:kapsch:ris-9160:-:::::::* cpe:2.3:h:kapsch:ris-9260:-:::::::* cpe:2.3:o:kapsch:ris-9260_firmware:3.2.0.829.23:::::::* cpe:2.3:o:kapsch:ris-9160_firmware:3.2.0.829.23:::::::* cpe:2.3:o:kapsch:ris-9260_firmware:3.8.0.1119.42:::::::* cpe:2.3:o:kapsch:ris-9260_firmware:4.6.0.1211.28:::::::*
First Time		Kapsch ris-9160 Firmware Kapsch ris-9260 Firmware Kapsch ris-9260 Kapsch ris-9160 Kapsch
References	~~() https://cwe.mitre.org/data/definitions/306.html -~~	() https://cwe.mitre.org/data/definitions/306.html - Technical Description
References	~~() https://phrack.org/issues/72/16_md -~~	() https://phrack.org/issues/72/16_md - Exploit, Third Party Advisory
References	~~() https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf -~~	() https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf - Broken Link
References	~~() https://www.kapsch.net/en -~~	() https://www.kapsch.net/en - Product
References	~~() https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en -~~	() https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en - Product

27 Aug 2025, 14:15

Type	Values Removed	Values Added
CWE		CWE-306
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
Summary		(es) Se descubrió que Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42 y v4.6.0.1211.28 contienen Android Debug Bridge (ADB) preinstalado (/mnt/c3platpersistent/opt/platform-tools/adb) y habilitado de manera predeterminada, lo que permite el acceso de shell root no autenticado al módem celular a través del usuario "kapsch" predeterminado.

26 Aug 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-26 15:15

Updated : 2025-09-16 19:27

NVD link : CVE-2025-25736

Mitre link : CVE-2025-25736

CVE.ORG link : CVE-2025-25736

JSON object : View

Products Affected

kapsch

ris-9160_firmware
ris-9260_firmware
ris-9160
ris-9260

CWE

CWE-306

Missing Authentication for Critical Function

9.8 /10