Medium severity6.6OSV Advisory· Published Dec 21, 2020· Updated Jun 17, 2026
CVE-2020-25860
CVE-2020-25860
Description
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:pengutronix:rauc:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:pengutronix:rauc:*:*:*:*:*:*:*:*range: <1.5
- (no CPE)range: <1.5
Patches
Vulnerability mechanics
References
2- github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vvnvdExploitThird Party Advisory
- www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-frameworknvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.