CVE-2025-47827

MEDIUM4.6

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature

Published Jun 5, 2025

Modified 3 months ago

Details

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

References

DETECTION

https://github.com/Zedeldi/CVE-2025-47827

WEB

https://github.com/Zedeldi/igelfs

ADVISORY

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827

WEB

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-47827

CVSS Analysis

CVSS v3.1

4.6

Exploitability

Attack Vector

PhysicalAV:P

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

4.6/CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Ecosystems

Timeline

PublishedJun 5, 2025

ModifiedFeb 26, 2026