CVE-2025-25734 is a medium-severity vulnerability identified in Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs), specifically in firmware versions 3.2.0.829.23, 3.8.0.1119.42, and 4.6.0.1211.28. The vulnerability arises from the presence of an unauthenticated EFI (Extensible Firmware Interface) shell accessible during the device's boot process. EFI shells provide a command-line interface at the firmware level, which can be used for system configuration and diagnostics. However, in this case, the EFI shell is exposed without authentication, allowing an attacker to execute arbitrary code or escalate privileges before the operating system loads. This can lead to full system compromise, including unauthorized firmware modifications, persistent malware implantation, or disruption of RSU functionality. The vulnerability is classified under CWE-1233 (Improper Control of the Boot Process) and CWE-284 (Improper Access Control), highlighting weaknesses in boot security and access restrictions. Exploitation does not require user interaction or prior authentication, but the attack vector is partially limited by the need for access to the boot environment, which may be physical or via network interfaces if exposed. The CVSS v3.1 score of 6.8 reflects high impact on confidentiality, integrity, and availability, but with a partial attack vector (physical or local network). No known exploits have been reported in the wild, and no patches have been released at the time of publication. The vulnerability poses a significant risk to the security and reliability of intelligent transportation systems relying on these RSUs.

For European organizations, this vulnerability threatens the integrity and availability of critical traffic management infrastructure. RSUs are integral to intelligent transportation systems, enabling vehicle-to-infrastructure communication, traffic monitoring, and safety applications. Exploitation could allow attackers to manipulate traffic signals, disrupt data collection, or implant persistent malware, potentially causing traffic congestion, accidents, or loss of public trust. Confidentiality breaches could expose sensitive traffic data or system configurations. Given the reliance on these RSUs in urban and highway environments, successful attacks could have cascading effects on transportation safety and efficiency. Additionally, disruption of these systems could impact emergency response coordination and smart city operations. The medium severity rating suggests a significant but not catastrophic risk, contingent on attacker access to the boot environment. European entities managing or operating these RSUs must consider the operational and reputational risks associated with this vulnerability.

1. Restrict physical access to RSUs by securing roadside cabinets and enclosures to prevent unauthorized boot access. 2. Limit network exposure of RSU management interfaces, employing network segmentation and strict firewall rules to reduce remote attack surfaces. 3. Monitor RSU boot logs and firmware integrity to detect unauthorized EFI shell access or modifications. 4. Implement hardware-based security features such as Secure Boot and Trusted Platform Module (TPM) if supported by the RSUs to prevent unauthorized boot code execution. 5. Engage with Kapsch TrafficCom for timely firmware updates or patches addressing this vulnerability and plan for prompt deployment once available. 6. Conduct regular security audits and penetration testing focusing on boot process security of RSUs. 7. Develop incident response plans specific to RSU compromise scenarios to minimize operational impact. 8. Consider deploying intrusion detection systems (IDS) that can monitor unusual network or device behavior indicative of exploitation attempts.