CVEvulnerability

CVE-2025-25734

6.8 MEDIUM Published 2025-08-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-08-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.8 MEDIUM — CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1233, CWE-284

Description

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.

Affected configurations

• kapsch ris-9160 firmware 3.2.0.829.23 • kapsch ris-9160 firmware 3.8.0.1119.42 • kapsch ris-9160 firmware 4.6.0.1211.28 • kapsch ris-9260 firmware 3.2.0.829.23 • kapsch ris-9260 firmware 3.8.0.1119.42 • kapsch ris-9260 firmware 4.6.0.1211.28

Related

Weakness · CWE (2)

  • CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection weakness
  • CWE-284 Improper Access Control weakness

References