CVE-2025-25734

PoC —

CVSS 3.1

6.8 medium

EPSS

<1%p28

Published

Aug 26, 2025 (Aug 26, 2025)

Modified

Jun 17, 2026

Description

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 was discovered to contain an unauthenticated EFI shell which allows attackers to execute arbitrary code or escalate privileges during the boot process.

Vendors: kapsch
Products: ris-9160 firmware, ris-9260 firmware
Weakness: CWE-284, CWE-1233
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.