CVE-2025-60892

{
  "id": "CVE-2025-60892",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-03T15:15:36.040",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintentionally re-adds a user's id_rsa.pub key from their local Windows machine to the authorized_keys file on the Raspberry Pi, even after the user explicitly deletes the key from the user interface. This creates an unintended attack surface, as it could allow an attacker to use a different key than the intended one to login to the device."
    },
    {
      "lang": "es",
      "value": "Un problema en Raspberry Pi Imager versión 1.9.6 para Windows, que afecta su función de personalización del sistema operativo. La configuración de ’autenticación de clave pública’ del imager vuelve a añadir involuntariamente la clave id_rsa.pub de un usuario desde su máquina Windows local al archivo authorized_keys en la Raspberry Pi, incluso después de que el usuario elimine explícitamente la clave de la interfaz de usuario. Esto crea una superficie de ataque no intencionada, ya que podría permitir a un atacante usar una clave diferente a la prevista para iniciar sesión en el dispositivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-03T20:59:06.699325Z",
          "id": "CVE-2025-60892",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/raspberrypi/rpi-imager/issues/1185",
      "source": "[email protected]"
    }
  ]
}