Security Resilience

CVE-2025-25732

Kapsch Ris-9160 Firmware 3.2.0.829.23 … 4.6.0.1211.28

Public PoC
Published
26 August 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0036 28th percentile
Risk Priority 50 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-25732 is a medium-severity Insecure Storage of Sensitive Information (CWE-922) vulnerability in Kapsch Ris-9160 Firmware. Its CVSS base score is 6.8 (Medium).

Operationally, ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability Data

Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows attackers to replace password hashes stored in the EEPROM with hashes of their own, leading to the escalation of…

more

privileges to root.

CWE(s)
CWE-922

Related Threats

CVEs Like This One

CVE-2025-25735Same product: Kapsch Ris-9160
CVE-2025-25737Same product: Kapsch Ris-9160
CVE-2025-25733Same product: Kapsch Ris-9160
CVE-2025-25734Same product: Kapsch Ris-9160
CVE-2025-25736Same product: Kapsch Ris-9160
CVE-2024-48770Shared CWE-922
CVE-2024-55931Shared CWE-922
CVE-2024-23217Shared CWE-922
CVE-2024-48883Shared CWE-922
CVE-2023-45859Shared CWE-922

Affected Assets

kapsch
ris-9160 firmware
3.2.0.829.23, 3.8.0.1119.42, 4.6.0.1211.28
kapsch
ris-9260 firmware
3.2.0.829.23, 3.8.0.1119.42, 4.6.0.1211.28

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Enforces approved authorizations for logical access to stored information, directly stopping unauthorized read/write.

SC-28 Protection of Information at Rest good match

Requires protection of confidentiality/integrity for information at rest, directly addressing insecure storage.

AC-6 Least Privilege good match

Limits privileges so only authorized accesses to sensitive stored data are permitted.

AC-16 Security and Privacy Attributes partial match

Associates security attributes with information to support proper access decisions on storage.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-922, a class-level weakness. Rules are authored against its narrower children: CWE-312.

References