CVE-2025-25736: Pre-Installed Android Debug Bridge in Kapsch TrafficCom RSU LEO

Overview

The vulnerability identified as CVE-2025-25736 is a critical security flaw discovered in certain versions of Kapsch TrafficCom RIS-9260 RSU LEO. This vulnerability is particularly precarious because it allows unauthenticated root shell access to the cellular modem via a default user, potentially leading to system compromise or data leakage.
The impact of this vulnerability is high due to the fact that it affects the Android Debug Bridge (ADB), a versatile command-line tool that allows devices to communicate with the Android operating system. If exploited, this vulnerability could lead to significant breaches in data privacy and system integrity.

Vulnerability Summary

CVE ID: CVE-2025-25736
Severity: Critical (9.8/10)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthenticated root shell access, potential system compromise or data leakage

Affected Products

Product | Affected Versions

Kapsch TrafficCom RIS-9260 RSU LEO | v3.2.0.829.23
Kapsch TrafficCom RIS-9260 RSU LEO | v3.8.0.1119.42
Kapsch TrafficCom RIS-9260 RSU LEO | v4.6.0.1211.28

How the Exploit Works

The vulnerability exists because the Android Debug Bridge (ADB) is pre-installed and enabled by default on the affected versions of the product. An attacker can exploit this vulnerability by accessing the cellular modem via the default ‘kapsch’ user, thereby gaining unauthenticated root shell access.

Conceptual Example Code

Although actual exploit code is not provided for ethical reasons, a conceptual scenario might look like this: an attacker connects to the device over the network and uses the ADB to access the system as the root user.

adb connect target_device_ip
adb root
adb shell

Once in the shell, the attacker could perform any number of malicious activities, from data theft to system compromise.