Vulnerability Description
Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of privileges to root.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kapsch | Ris-9160 Firmware | 3.2.0.829.23 |
| Kapsch | Ris-9160 | - |
| Kapsch | Ris-9260 Firmware | 3.2.0.829.23 |
| Kapsch | Ris-9260 | - |
Related Weaknesses (CWE)
References
- https://cwe.mitre.org/data/definitions/922.htmlTechnical Description
- https://phrack.org/issues/72/16_mdExploitThird Party Advisory
- https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dBroken Link
- https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3Product
- https://www.kapsch.net/enProduct
- https://www.kapsch.net/en/press/releases/ktc-20200813-pr-enProduct
FAQ
What is CVE-2025-25732?
CVE-2025-25732 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password h...
How severe is CVE-2025-25732?
CVE-2025-25732 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-25732?
Check the references section above for vendor advisories and patch information. Affected products include: Kapsch Ris-9160 Firmware, Kapsch Ris-9160, Kapsch Ris-9260 Firmware, Kapsch Ris-9260.