SWUpdate EUVD-2025-210052

Requires local shell access on the device as an unprivileged user (CVSS PR:L) plus the ability to manipulate filesystem entries within paths SWUpdate operates on while a signed update is being processed; the AT:P flag reflects that the attacker must win a race against SWUpdate's check/use sequence in swupdate_remove_directory() and related paths. No network exposure and no user interaction by another principal are needed (UI:N), but exploitation is bounded to deployments where SWUpdate runs privileged on shared systems and where unprivileged users can either trigger an update or predict/observe when one will run.

CVSS 4.0 vector AV:L/AC:L/AT:P/PR:L/UI:N with VC:H/VI:H/VA:H signals local, low-complexity, low-privilege exploitation requiring an attack prerequisite (the race window) and yielding full host compromise - consistent with a classic TOCTOU root escalation on an embedded updater. The AT:P (attack requirements: present) and need to win a race reduce reliability versus a pure logic bug, but the scope is the device root and the threat model explicitly includes untrusted local users who could otherwise only deliver signed bundles. EPSS and KEV data were not provided in the input; absence of KEV and any referenced PoC suggests this is not currently mass-exploited, but the impact ceiling (sign-check bypass on devices that rely on SWUpdate as a security boundary) makes it a priority fix for any product that exposes update functionality to lower-privileged users or processes.

A local unprivileged user on an embedded Linux device with SWUpdate installed initiates a legitimate signed update and, during the brief window between SWUpdate validating/staging files and acting on them, swaps a staging directory with a symlink or attacker-controlled path. SWUpdate, running as root, then executes scripts or removes/writes content along the substituted path, yielding root execution or installation of untrusted content despite the bundle signature check.