CVE-2025-25735 is a vulnerability affecting Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) in specific firmware versions: v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28. These RSUs are critical components in intelligent transportation systems, responsible for vehicle-to-infrastructure communication and traffic management. The vulnerability arises from the lack of SPI Protected Range Registers (PRRs) in the SPI flash memory of these devices. PRRs are hardware-enforced memory protection mechanisms that prevent unauthorized modification of specific flash memory regions. Without PRRs, an attacker who has already gained software-level access to the RSU can modify the SPI flash memory in real-time. This means the attacker can alter firmware or configuration data persistently, potentially implanting malicious code or disabling security features. Although exploitation requires prior software-level access to the device, the absence of PRRs significantly lowers the barrier for persistent compromise and firmware tampering. This vulnerability does not currently have a CVSS score and no known exploits in the wild have been reported. However, the impact of such a vulnerability in critical infrastructure components like RSUs could be severe, enabling attackers to disrupt traffic management systems, cause denial of service, or facilitate further attacks on connected infrastructure.

For European organizations, especially those involved in transportation infrastructure and smart city deployments, this vulnerability poses a significant risk. Kapsch TrafficCom is a well-known supplier of traffic management solutions in Europe, and their RSUs are widely deployed across highways and urban areas. Exploitation could lead to unauthorized firmware modifications, allowing attackers to manipulate traffic signals, disable safety features, or create persistent backdoors. This could result in traffic disruptions, increased accident risks, and undermine public trust in intelligent transportation systems. Additionally, compromised RSUs could be leveraged as entry points for lateral movement into broader critical infrastructure networks. The real-time modification capability increases the risk of stealthy persistent threats that are difficult to detect and remediate. Given the strategic importance of transportation infrastructure in Europe, such disruptions could have cascading effects on logistics, emergency response, and economic activities.

1. Immediate firmware updates: Organizations should coordinate with Kapsch TrafficCom to obtain and deploy firmware updates that implement SPI Protected Range Registers or equivalent hardware/software protections. 2. Access control hardening: Restrict software-level access to RSUs by enforcing strict authentication, network segmentation, and limiting administrative interfaces to trusted personnel and networks. 3. Continuous monitoring: Deploy integrity monitoring solutions to detect unauthorized changes in RSU firmware or configuration files. 4. Incident response readiness: Develop and test incident response plans specific to RSU compromise scenarios, including rapid isolation and recovery procedures. 5. Supply chain verification: Validate firmware authenticity using cryptographic signatures and secure boot mechanisms to prevent unauthorized firmware modifications. 6. Physical security: Ensure RSUs are physically secured to prevent tampering that could facilitate software-level access. 7. Network segmentation: Isolate RSUs from general IT networks to reduce attack surface and limit lateral movement opportunities.