CVE-2025-60892

An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature

Medium · published November 3, 2025

CVSS v3.1
6.8
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. The imager's 'public-key authentication' setting unintentionally re-adds a user's id_rsa.pub key from their local Windows machine to the authorized_keys file on the Raspberry Pi, even after the user explicitly deletes the key from the user interface. This creates an unintended attack surface, as it could allow an attacker to use a different key than the intended one to login to the device.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00169 · 6.0th percentile
Published
2025-11-03T00:00Z
EPSS history
Timeline
  • 03 NOV 00:00Z
    An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature
    cvelistv5