CVE-2025-25735

PoC —

CVSS 3.1

4.6 medium

EPSS

<1%p18

Published

Aug 26, 2025 (Aug 26, 2025)

Modified

Jun 17, 2026

Description

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers (PRRs), allowing attackers with software running on the system to modify SPI flash in real-time.

Vendors: kapsch
Products: ris-9160 firmware, ris-9260 firmware
Weakness: CWE-1233
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.