{"id":"CVE-2025-25735","aliases":["EUVD-2025-25797","GHSA-g8xm-9pfm-3736"],"status":"published","title":"Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4...","description":"Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00274,"percentile":0.19993,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1233"],"published":"2025-08-26T00:00:00Z","modified":"2026-06-17T09:01:04Z","products":[{"vendor":"kapsch","product":"ris-9160_firmware"},{"vendor":"kapsch","product":"ris-9260_firmware"}],"references":[{"url":"https://www.kapsch.net/en","tags":["Product"]},{"url":"https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf","tags":["Broken Link"]},{"url":"https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf","tags":["Product"]},{"url":"https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en","tags":["Product"]},{"url":"https://cwe.mitre.org/data/definitions/1233.html","tags":["Technical Description"]},{"url":"https://phrack.org/issues/72/16_md","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25735"},{"url":"https://github.com/advisories/GHSA-g8xm-9pfm-3736"}],"sources":{"cve":[{"id":"CVE-2025-25735","description":"Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.","status":"published","published":"2025-08-26T00:00:00Z","modified":"2025-10-22T14:58:09.571Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-1233"],"updated_at":"2026-11-02T14:32:32.30152Z"}],"euvd":[{"id":"EUVD-2025-25797","description":"Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.","status":"published","published":"2025-08-26T00:00:00Z","modified":"2025-10-22T14:58:09Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:38.726368Z"}],"ghsa":[{"id":"GHSA-g8xm-9pfm-3736","title":"Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4...","description":"Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.","status":"published","published":"2025-08-26T15:31:02Z","modified":"2025-08-27T15:34:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-1233"],"updated_at":"2026-11-02T15:03:24.943278Z"}],"nvd":[{"id":"CVE-2025-25735","description":"Kapsch TrafficCom RIS-9160 \u0026 RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.","status":"published","published":"2025-08-26T15:15:42.617Z","modified":"2026-06-17T09:01:04.063Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1233"],"updated_at":"2026-11-02T14:11:25.826804Z"}]}}