CVE-2025-25736
📋 TL;DR
This vulnerability allows unauthenticated attackers to gain root shell access to Kapsch TrafficCom RIS-9260 RSU devices via Android Debug Bridge (ADB) enabled by default. Affected systems include RIS-9260 RSU LEO versions v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 with default configurations.
💻 Affected Systems
- Kapsch TrafficCom RIS-9260 RSU LEO
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to modify traffic control systems, disrupt operations, or use devices as footholds into connected networks.
Likely Case
Unauthorized access to device configuration, potential data exfiltration, and disruption of roadside unit functionality.
If Mitigated
Limited impact if ADB access is properly restricted and devices are isolated from untrusted networks.
🎯 Exploit Status
Exploitation requires network access to ADB port and knowledge of default credentials. No authentication bypass needed beyond default configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with vendor for patched versions
Vendor Advisory: https://www.kapsch.net/en
Restart Required: No
Instructions:
1. Contact Kapsch TrafficCom for security updates. 2. Apply vendor-provided patches. 3. Verify ADB is disabled or properly secured.
🔧 Temporary Workarounds
Disable ADB Service
allDisable Android Debug Bridge service to prevent unauthorized access
adb shell pm disable com.android.shell
adb shell setprop persist.service.adb.enable 0
Change Default Credentials
allChange default 'kapsch' user password to strong, unique credentials
adb shell passwd kapsch
🧯 If You Can't Patch
- Network segmentation: Isolate RIS-9260 devices from untrusted networks using firewalls
- Access control: Restrict network access to ADB port (default 5555) to authorized management systems only
🔍 How to Verify
Check if Vulnerable:
Check if ADB service is running and accessible: 'adb connect <device_ip>:5555' followed by 'adb shell' with 'kapsch' userCheck Version:
Check device firmware version via web interface or console: 'cat /etc/version' or similarVerify Fix Applied:
Attempt ADB connection after remediation: 'adb connect <device_ip>:5555' should fail or require proper authentication📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts to ADB service
- Successful ADB connections from unauthorized sources
- Root shell access via ADB
Network Indicators:
- Unexpected connections to port 5555 (ADB)
- ADB protocol traffic from non-management systems
SIEM Query:
source_port:5555 OR destination_port:5555 AND (protocol:adb OR service:android_debug)