CVE-2025-25734
Kapsch Ris-9160 Firmware 3.2.0.829.23 … 4.6.0.1211.28
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-25734 is a medium-severity Improper Access Control (CWE-284) vulnerability in Kapsch Ris-9160 Firmware. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25798
Vulnerability Data
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access, stopping unauthorized actors from reaching resources.
Enforces flow-control policies that restrict information movement between subjects and objects.
Documents duties and assigns access so that no single account can bypass intended restrictions.
Limits each account to the minimum privileges needed, reducing the chance of unauthorized access.
CM-5 mandates documented and enforced access restrictions on changes to system configuration, covering hardware register lock mechanisms.
Defines account types, assigns/removes access, and reviews accounts to ensure only authorized actors can reach resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and verification directly enforce lock-bit settings on security-sensitive registers.
Pre-acquisition integrity checks can identify hardware lacking effective register lock-bit controls.
Hardware replacement decisions can address devices lacking functional lock-bit protection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining requirements, defining/implementing topic-specific access control policy+rules (with explicit references to 8.3, 5.16, 5.18), and enforcing authorized access while preventing unauthorized access, which squarely stops exploitation of most CWE-284 instances; the bounded remainder is the physical slice (explicitly delegated to 7.2-7.4) plus any second-order defects like path traversal that are not authorization decisions.
A.5.16's identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) directly stops most improper access by ensuring the actor in an access decision is correctly identified and authorized; the bounded remainder is non-identity mechanisms in CWE-284 such as path traversal or CSRF that do not turn on actor identity at all.
A.5.18 directly governs the provisioning, review, adjustment and timely revocation of both physical and logical access rights per business rules, segregation of duties and risk-evaluated changes/terminations; this stops most unauthorized-actor exploitation paths named by CWE-284, with a bounded remainder (e.g. path-traversal or CSRF cases that are not authorization decisions at all)
A.6.7's policy, rules, mechanisms, authentication requirements, remote access controls, network restrictions, and device measures (e.g. screen locks, firewalls, malware protection) directly stop unauthorized actors from exploiting improper access control in remote settings; remainder is non-remote or physical-only slices of CWE-284 (as in AC-3's own mostly precedent).
A.8.1 mandates access controls, storage encryption, software restrictions, malware protection, remote lock/wipe, physical/logical device protections, and policy-driven enforcement that stop unauthorized actors from exploiting improper access control on endpoints; remainder is non-endpoint or non-device slices of CWE-284 (e.g. server-side authorization logic).
A.8.2 directly controls allocation, review, expiry, temporary use, separate identities and heightened authentication for privileged rights per the access policy, which stops most improper-access-control exploitation paths for privileged resources; the bounded remainder is non-privileged improper access control (e.g. ordinary user rights, path traversal, CSRF).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.