CVE-2025-60892: Infoleak
An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintentionally re-adds a user's idrsa.pub key from their local Windows machine to the authorizedkeys file on the Raspberry Pi, even after the user explicitly deletes the key from the user interface. This creates an unintended attack surface, as it could allow an attacker to use a different key than the intended one to login to the device.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60892?
CVE-2025-60892 has been rated as a medium severity vulnerability due to its potential to expose sensitive SSH keys.
How do I fix CVE-2025-60892?
To fix CVE-2025-60892, users should update Raspberry Pi Imager to the latest version and manually check their authorized_keys file.
What is the impact of CVE-2025-60892?
CVE-2025-60892 impacts the OS customization feature, allowing unintended re-addition of SSH public keys which could lead to unauthorized access.
Who is affected by CVE-2025-60892?
Users of Raspberry Pi Imager version 1.9.6 on Windows are affected by CVE-2025-60892.
Is there a workaround for CVE-2025-60892?
A temporary workaround for CVE-2025-60892 is to avoid using the public-key authentication feature until the issue is resolved.