Threats Tagged 'cve-2025-25732'

CVE-2025-25732 is a medium severity vulnerability affecting Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) in specific firmware versions. The flaw stems from incorrect access control in the EEPROM component, allowing attackers to overwrite stored password hashes with their own. This enables privilege escalation to root without requiring authentication or user interaction. The vulnerability impacts confidentiality, integrity, and availability of the affected RSUs. Although no known exploits are currently reported in the wild, the potential for attackers to gain full control over critical traffic infrastructure devices is significant. European organizations operating these RSUs, especially in countries with extensive intelligent transportation systems, face increased risk. Mitigation requires strict physical and network access controls, firmware updates when available, and monitoring for anomalous device behavior. Countries with widespread deployment of Kapsch RSUs, such as Germany, Austria, and the Netherlands, are most likely to be affected given their advanced traffic management deployments. The vulnerability’s CVSS score of 6.8 reflects its medium severity, balancing the high impact with the requirement for physical or network proximity to exploit.

MediumVulnerabilityGermanyAustriaNetherlands+4#cve#cve-2025-25732