CVE-2025-60892

Name of the Vulnerable Software and Affected Versions Raspberry Pi Imager version 1.9.6

Description An issue exists in the OS customization feature of Raspberry Pi Imager. The 'public-key authentication' setting unintentionally re-adds a user's id rsa.pub key from their local Windows machine to the authorized keys file on the Raspberry Pi, even after the user deletes the key through the user interface. This could allow an attacker to use a different key to login to the device, creating an unintended attack surface.

Recommendations Update to a newer version of Raspberry Pi Imager that contains a fix for this vulnerability.