CVE-2025-25737
📋 TL;DR
This vulnerability allows attackers to bypass authentication on Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units via brute-force attacks due to weak BIOS password requirements. Organizations using these specific RSU versions in traffic management systems are affected. Attackers could gain unauthorized access to device BIOS settings.
💻 Affected Systems
- Kapsch TrafficCom RIS-9160
- Kapsch TrafficCom RIS-9260
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full BIOS control, potentially disabling security features, installing persistent malware, or bricking devices, disrupting traffic management systems.
Likely Case
Attackers gain unauthorized BIOS access to modify boot settings, disable security features, or extract sensitive system information.
If Mitigated
With strong password policies and network segmentation, impact is limited to isolated devices with minimal operational disruption.
🎯 Exploit Status
Requires physical or network access to RSU BIOS interface; brute-force tools needed but widely available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Kapsch for updated firmware versions addressing CVE-2025-25737
Vendor Advisory: https://www.kapsch.net/en
Restart Required: No
Instructions:
1. Contact Kapsch support for patched firmware. 2. Backup current configuration. 3. Apply firmware update via management interface. 4. Verify BIOS password requirements are enforced.
🔧 Temporary Workarounds
Enforce Strong BIOS Passwords
allManually configure complex passwords for Supervisor and User BIOS accounts exceeding minimum length and complexity requirements.
Access BIOS setup during boot > Security settings > Set strong passwords for all accounts
🧯 If You Can't Patch
- Implement network segmentation to isolate RSUs from untrusted networks
- Enable physical security controls and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or console; if matches affected versions and BIOS passwords are weak/short, device is vulnerable.Check Version:
Login to RSU management interface and check System Information or Firmware Version sectionVerify Fix Applied:
Verify firmware version is updated beyond affected versions and test that BIOS rejects weak passwords during setup.📡 Detection & Monitoring
Log Indicators:
- Multiple failed BIOS login attempts
- BIOS configuration changes outside maintenance windows
Network Indicators:
- Unusual traffic to RSU management interfaces
- Brute-force patterns to BIOS access ports
SIEM Query:
source="rsu_logs" AND (event="authentication_failed" AND count>10) OR event="bios_config_change"🔗 References
- https://cwe.mitre.org/data/definitions/521.html
- https://phrack.org/issues/72/16_md
- https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataSheet.pdf
- https://www.kapsch.net/_Resources/Persistent/55fb8d0fb279262809eac88d457894db1b3efcd5/Kapsch_RIS-9160_Datasheet_EN.pdf
- https://www.kapsch.net/en
- https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en
