CVE-2025-47827mediumunder attackCWE-347

CVE-2025-47827

Published · Updated

Follow this CVE+ Monitor IGEL OS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 4.6epss 5.2%
from disclosure to weaponsame day
Published on NVDJun 5
1st PoCMay 20
CISA KEV+131d
Action required by CISAfederal deadline: 2025-11-04

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

IGEL OS versions before 11 have a flaw in their Secure Boot system that allows someone to load an unverified operating system by bypassing signature checks in the igel-flash-driver module. This bypasses a key security feature designed to prevent unauthorized system changes.

Technical detail

The igel-flash-driver module in IGEL OS < 11 fails to properly validate cryptographic signatures during Secure Boot verification, allowing an attacker with local or physical access to mount a crafted SquashFS root filesystem that lacks valid signatures. This undermines the integrity verification mechanism that protects against unauthorized kernel and filesystem modifications.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.