CVE-2020-25860

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
n/a	Pengutronix RAUC	All versions before 1.5

References

https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vvExploit, Third Party Advisory
https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-frameworkExploit, Third Party Advisory
https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vvExploit, Third Party Advisory
https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-frameworkExploit, Third Party Advisory

Timeline

Published: Dec 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-258627.5In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the TCP dissector could crash. This was addressed in epan/dissectors/pack CVE-2020-258637.5In Wireshark 3.2.0 to 3.2.6, 3.0.0 to 3.0.13, and 2.6.0 to 2.6.20, the MIME Multipart dissector could crash. This was addressed in epan/diss CVE-2020-258646.1HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1 CVE-2020-258667.5In Wireshark 3.2.0 to 3.2.6 and 3.0.0 to 3.0.13, the BLIP protocol dissector has a NULL pointer dereference because a buffer was sized for c CVE-2020-258675.3SoPlanning before 1.47 doesn't correctly check the security key used to publicly share plannings. It allows a bypass to get access without a CVE-2020-258687.5Pexip Infinity 22.x through 24.x before 24.2 has Improper Input Validation for call setup. An unauthenticated remote attacker can trigger a CVE-2020-258697.5An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necess CVE-2020-25879.9Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that a CVE-2020-258724.9A vulnerability exists within the FileManagerController.php function in FrogCMS 0.9.5 which allows an attacker to perform a directory traver CVE-2020-258736.5A directory traversal vulnerability in the component system/manager/class/web/database.php was discovered in Baijiacms V4 which allows attac CVE-2020-258755.4A stored cross site scripting (XSS) vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arb CVE-2020-258765.4A stored cross site scripting (XSS) vulnerability in the 'Pages' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbit