CVE-2025-25735
Kapsch Ris-9160 Firmware 3.2.0.829.23 … 4.6.0.1211.28
Raw vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-25735 is a medium-severity Security-Sensitive Hardware Controls with Missing Lock Bit Protection (CWE-1233) vulnerability in Kapsch Ris-9160 Firmware. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25797
Vulnerability Data
Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorizations that would stop unauthorized writes to lock-bit-protected hardware registers.
Least privilege limits which subjects may alter security-sensitive configuration registers even when lock bits are present.
CM-5 mandates documented and enforced access restrictions on changes to system configuration, covering hardware register lock mechanisms.
Isolating security functions reduces the attack surface for tampering with hardware configuration registers protected by lock bits.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and verification directly enforce lock-bit settings on security-sensitive registers.
Pre-acquisition integrity checks can identify hardware lacking effective register lock-bit controls.
Hardware replacement decisions can address devices lacking functional lock-bit protection.