MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2020-25860

CVSS 6.6v3.1pub. 2020-12-21upd. 2024-11-21

The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Pengutronix Rauc

    APP
    Pengutronix
    < 1.5
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Race Condition
CWE
References

Related vulnerabilities

CVE-2026-34155HIGH7.2same product

RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'p...

CVE-2020-13910CRITICAL9.1PL ✓same vendor

Barebox NFS: out-of-bounds read w net/nfs.c (nfs_read_reply)

CVE-2019-15937CRITICAL9.8PL ✓same vendor

Zdalny buffer overflow w Pengutronix Barebox — funkcja nfs_readlink_reply

CVE-2019-15938CRITICAL9.8PL ✓same vendor

Zdalny buffer overflow w Pengutronix Barebox — funkcja nfs_readlink_req

CVE-2026-34960HIGH7.1same vendor

barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within ...