Cyber Resilience

CVE-2025-25735

Kapsch Ris-9160 Firmware 3.2.0.829.23 … 4.6.0.1211.28

Public PoC
Published
26 August 2025
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 4.6
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0026 18th percentile
Risk Priority 36 floored blend · peak EPSS

Summary

CVE-2025-25735 is a medium-severity Security-Sensitive Hardware Controls with Missing Lock Bit Protection (CWE-1233) vulnerability in Kapsch Ris-9160 Firmware. Its CVSS base score is 4.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Pre-OS Boot (T1542); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.

CWE(s)
CWE-1233

Related Threats

MITRE ATT&CK Enterprise Techniques

T1542 Pre-OS Boot Stealth
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
attack.mitre.org →
T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
attack.mitre.org →
T1542.002 Component Firmware Stealth
Adversaries may modify component firmware to persist on systems.
attack.mitre.org →
T1601 Modify System Image Defense Impairment
Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.
attack.mitre.org →
T1495 Firmware Corruption Impact
Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or…
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-25733Same product: Kapsch Ris-9160
CVE-2025-25734Same product: Kapsch Ris-9160
CVE-2025-25732Same product: Kapsch Ris-9160
CVE-2025-25736Same product: Kapsch Ris-9160
CVE-2025-25737Same product: Kapsch Ris-9160
CVE-2025-61971Shared CWE-1233
CVE-2025-61972Shared CWE-1233

Affected Assets

kapsch
ris-9160 firmware
3.2.0.829.23, 3.8.0.1119.42, 4.6.0.1211.28
kapsch
ris-9260 firmware
3.2.0.829.23, 3.8.0.1119.42, 4.6.0.1211.28

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

AC-3 directly requires enforcement of authorizations that would stop unauthorized writes to lock-bit-protected hardware registers.

AC-6 Least Privilege good match

Least privilege limits which subjects may alter security-sensitive configuration registers even when lock bits are present.

CM-5 Access Restrictions for Change good match

CM-5 mandates documented and enforced access restrictions on changes to system configuration, covering hardware register lock mechanisms.

SC-3 Security Function Isolation partial match

Isolating security functions reduces the attack surface for tampering with hardware configuration registers protected by lock bits.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-01 mostly match
prevents

Hardened configuration baselines and verification directly enforce lock-bit settings on security-sensitive registers.

ID.RA-09 partial match
prevents

Pre-acquisition integrity checks can identify hardware lacking effective register lock-bit controls.

PR.PS-03 partial match
prevents

Hardware replacement decisions can address devices lacking functional lock-bit protection.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect missing lock-bit protection during hardware/firmware validation.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture principles require hardware lock-bit protection for critical configuration registers.

A.8.9 Configuration management partial match
degrades

Configuration management enforces lock-bit settings and prevents unauthorized hardware register changes.

A.8.28 Secure coding none match
none

Secure coding practices can include checks for proper lock-bit usage in firmware.

A.8.32 Change management none match
none

Change management processes can require verification that lock bits remain set after updates.

References