CVE-2025-25737

MEDIUM EPSS 28.8%
Published Aug 26, 202510mo ago · Modified Jun 17, 20261w ago
6.8 CVSS 3.1
Medium
Find Similar
Published Aug 26, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack secure password requirements for its BIOS Supervisor and User accounts, allowing attackers to bypass authentication via a bruteforce attack.

CVSS Details

Base Score
6.8
Exploitability
0.9
Impact
5.9
Vector string
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Physical
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
28.8% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-521

Affected Products 8

VendorProductVersionRange
kapschris-9160_firmware3.2.0.829.23any
kapschris-9160_firmware3.8.0.1119.42any
kapschris-9160_firmware4.6.0.1211.28any
kapschris-9160*any
kapschris-9260_firmware3.2.0.829.23any
kapschris-9260_firmware3.8.0.1119.42any
kapschris-9260_firmware4.6.0.1211.28any
kapschris-9260*any

References 6

  • cwe.mitre.org https://cwe.mitre.org/data/definitions/521.html
    Technical Description
  • phrack.org https://phrack.org/issues/72/16_md
    ExploitThird Party Advisory
  • kapsch.net https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
    Broken Link
  • kapsch.net https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf
    Product
  • kapsch.net https://www.kapsch.net/en
    Product
  • kapsch.net https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en
    Product

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.