CVE-2025-25733
Kapsch Ris-9160 Firmware 3.2.0.829.23 … 4.6.0.1211.28
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-25733 is a low-severity Security-Sensitive Hardware Controls with Missing Lock Bit Protection (CWE-1233) vulnerability in Kapsch Ris-9160 Firmware. Its CVSS base score is 3.5 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25800
Vulnerability Data
Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of…
more
the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorizations that would stop unauthorized writes to lock-bit-protected hardware registers.
Least privilege limits which subjects may alter security-sensitive configuration registers even when lock bits are present.
CM-5 mandates documented and enforced access restrictions on changes to system configuration, covering hardware register lock mechanisms.
Isolating security functions reduces the attack surface for tampering with hardware configuration registers protected by lock bits.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and verification directly enforce lock-bit settings on security-sensitive registers.
Pre-acquisition integrity checks can identify hardware lacking effective register lock-bit controls.
Hardware replacement decisions can address devices lacking functional lock-bit protection.