Threats Tagged 'cve-2025-25733'

CVE-2025-25733 is a vulnerability in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) across multiple firmware versions. It allows attackers with physical proximity to modify SPI flash memory regions due to incorrect access control. This can degrade the security posture of the affected devices by potentially enabling unauthorized firmware or configuration changes. The vulnerability has a CVSS score of 3. 5, indicating low severity, primarily impacting confidentiality and integrity without affecting availability. Exploitation requires physical access and no user interaction or authentication is needed. No known exploits are currently reported in the wild. European organizations relying on these RSUs for traffic management and infrastructure security could face risks of tampering or sabotage if physical security is insufficient. Mitigation involves enhancing physical security controls, monitoring for unauthorized access, and applying vendor patches once available. Countries with extensive smart traffic infrastructure deployments and Kapsch TrafficCom presence, such as Germany, Austria, and the Netherlands, are most likely to be affected.

LowVulnerabilityGermanyAustriaNetherlands+4#cve#cve-2025-25733