medium6.8
CVE-2025-25734
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI …
Impact
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kapsch | Ris-9160 Firmware | Versions 3.2.0.829.23, 3.8.0.1119.42, 4.6.0.1211.28 |
| Kapsch | Ris-9260 Firmware | Versions 3.2.0.829.23, 3.8.0.1119.42, 4.6.0.1211.28 |
Weakness classification
References
- NVD record
- CVE.org record
- https://cwe.mitre.org/data/definitions/1233.html
- https://phrack.org/issues/72/16_md
- https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
- https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf
- https://www.kapsch.net/en
- https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en