CVE-2020-25860
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
- Record
CVE-2020-25860- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.1 High
AV:N/AC:H/Au:S/C:C/I:C/A:C - Weakness
- CWE-367
- Updated
- 2026-11-02
CVE List No score
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
- Record
CVE-2020-25860- Weakness
- CWE-367
- Updated
- 2026-11-02
EUVDEUVD-2020-18493 No score
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
- Record
EUVD-2020-18493- Updated
- 2026-11-03
OSV
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
- Record
CVE-2020-25860- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-25860
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
- Record
DEBIAN-CVE-2020-25860- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-25860
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
- Record
UBUNTU-CVE-2020-25860- CVSS 3.1
- 6.6 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
raucDebian:12 |
before 1.5-1 | 1.5-1 |
raucDebian:13 |
before 1.5-1 | 1.5-1 |
raucDebian:14 |
before 1.5-1 | 1.5-1 |
raucUbuntu:20.04:LTS |
All versions, plus listed versions 1.1-21.2-1 |
None known |
raucUbuntu:22.04:LTS |
All versions, plus listed versions 1.5.1-11.5.1-1build11.6-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | rauc/rauc-1.5-integration | 2020-11-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25860 is a medium vulnerability (CVSS 6.6) in Pengutronix Rauc, published December 21, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in rauc 1.5-1.