Threats Tagged 'cve-2025-25734'

CVE-2025-25734 is a vulnerability affecting Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) in specific firmware versions. It involves an unauthenticated EFI shell accessible during the boot process, allowing attackers to execute arbitrary code or escalate privileges without any authentication or user interaction. The vulnerability impacts confidentiality, integrity, and availability of the affected devices. Exploitation requires physical or network-level access to the device's boot environment, which is typically protected but may be exposed in certain deployment scenarios. No known exploits are currently in the wild, and no patches have been published yet. The CVSS score is 6. 8 (medium severity), reflecting the significant impact but limited attack vector. European organizations relying on these RSUs for traffic management and intelligent transportation systems could face operational disruptions, data compromise, or unauthorized control. Countries with extensive deployments of Kapsch TrafficCom infrastructure, especially those with critical transport networks, are at higher risk. Mitigation involves restricting physical and network access to RSUs, monitoring boot processes, and applying vendor updates once available.

MediumVulnerabilityGermanyAustriaFrance+6#cve#cve-2025-25734