CVE-2025-25736

Katalog CVE

CVSS 6.8 · Medium EPSS 0,33%

Kerentanan Missing Authentication for Critical Function pada kapsch ris-9160 firmware, kapsch ris-9260 firmware. Skor CVSS 3.1 6.8 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Kapsch TrafficCom RIS-9260 RSU LEO v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to contain Android Debug Bridge (ADB) pre-installed (/mnt/c3platpersistent/opt/platform-tools/adb) and enabled by default, allowing unauthenticated root shell access to the cellular modem via the default 'kapsch' user.

Rincian

Terbit di NVD

26 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber CISA ADP
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://phrack.org/issues/72/16_md exploit · advisory pihak ketiga
• https://cwe.mitre.org/data/definitions/306.html deskripsi teknis
• https://www.kapsch.net/_Resources/Persistent/3d251a8445e0bf50093903ad70b3dbed34dec7e7/KTC-CVS_RIS-9260_DataShe... broken link
• https://www.kapsch.net/en product
• https://www.kapsch.net/en/press/releases/ktc-20200813-pr-en product