VulnerabilityPublished 26 Aug 2025Updated 22 Oct 2025

CVE-2025-25733: CVE-2025-25733 is a

Source CVE Database V5

Not known to be exploited · CVSS 3.5 Low.

Data as of 26 Oct 2026, 11:07 UTC

CVSS 3.1 base score

3.5Low

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector: Physical
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: Low
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Physical: The attack requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief or persistent.
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 26 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Enhance physical security measures around RSU installations, including tamper-evident seals, locked enclosures, and surveillance cameras to deter and detect unauthorized access.
Implement regular physical inspections and integrity checks of RSUs to identify signs of tampering or unauthorized modifications.
Coordinate with Kapsch TrafficCom to obtain and apply firmware updates or patches addressing this vulnerability once released.
Employ cryptographic verification of firmware and configuration files to detect unauthorized changes to SPI flash contents.
Restrict physical access to RSUs to authorized personnel only, supported by access control policies and logging.
Integrate anomaly detection systems that monitor RSU behavior and alert on deviations potentially caused by firmware tampering.
Develop incident response plans specific to physical tampering scenarios involving RSUs to ensure rapid containment and recovery.

Description

CVE-2025-25733 is a vulnerability in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) across multiple firmware versions. It allows attackers with physical proximity to modify SPI flash memory regions due to incorrect access control. This can degrade the security posture of the affected devices by potentially enabling unauthorized firmware or configuration changes. The vulnerability has a CVSS score of 3.5, indicating low severity, primarily impacting confidentiality and integrity without affecting availability. Exploitation requires physical access and no user interaction or authentication is needed. No known exploits are currently reported in the wild. European organizations relying on these RSUs for traffic management and infrastructure security could face risks of tampering or sabotage if physical security is insufficient. Mitigation involves enhancing physical security controls, monitoring for unauthorized access, and applying vendor patches once available. Countries with extensive smart traffic infrastructure deployments and Kapsch TrafficCom presence, such as Germany, Austria, and the Netherlands, are most likely to be affected.

Impact

For European organizations, especially those managing smart city infrastructure and traffic control systems, this vulnerability poses a risk of physical tampering with roadside units. Unauthorized modification of SPI flash memory could allow attackers to alter firmware or configurations, potentially leading to incorrect traffic data reporting, disruption of traffic management, or covert insertion of backdoors for future attacks. Although the vulnerability requires physical access, roadside units are often deployed in publicly accessible locations, increasing the risk of exploitation. The impact on confidentiality and integrity could affect data accuracy and system trustworthiness, undermining traffic safety and operational efficiency. While availability is not directly impacted, compromised RSUs could indirectly cause traffic disruptions or safety hazards. The low CVSS score reflects the limited attack vector and impact scope, but the critical nature of transportation infrastructure elevates the importance of addressing this issue promptly.

Summary

CVE-2025-25733 identifies an incorrect access control vulnerability in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) running firmware versions 3.2.0.829.23, 3.8.0.1119.42, and 4.6.0.1211.28. The SPI flash memory stores critical firmware and configuration data essential for the RSU's operation and security. Due to improper access restrictions, an attacker with physical proximity can directly modify arbitrary regions of the SPI flash chip. This unauthorized modification capability can lead to degradation of the device's security posture by enabling firmware tampering, insertion of malicious code, or alteration of security-critical parameters. The vulnerability does not require authentication or user interaction but does require physical access, limiting remote exploitation. The CVSS v3.1 base score is 3.5 (low severity), reflecting limited impact on confidentiality and integrity, no impact on availability, and low attack vector scope (physical). No public exploits or patches are currently available, but the vulnerability is officially published and tracked under CWE-1233 (Improper Access Control). The affected devices are integral components of intelligent transportation systems, used for traffic monitoring and management, making their security critical to infrastructure resilience.

CWE-1233Security-Sensitive Hardware Controls with Missing Lock Bit Protection (opens in a new tab)
Base weakness
The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.
Architecture and Design · Implementation · Testing
Security lock bit protections must be reviewed for design inconsistency and common weaknesses.; Security lock programming flow and lock properties must be tested in pre-silicon and post-silicon testing.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
Third Party Javascript Management (opens in a new tab)
Virtual Patching (opens in a new tab)
OWASP ASVS 4.0.3
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
V1.10.1 (opens in a new tab)
Attack patterns
Exploitation of Improperly Controlled Registers (opens in a new tab)
Configuration/Environment Manipulation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 29 Oct 2025, 15:23 UTC

WeaknessesCWE-1233

Technical details

References

Community reviews

Related threats