CVE-2025-47827: IGEL OS Secure Boot bypass via improper signature verification

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with public exploit code and defeats a core security control, though it requires physical access and has a medium CVSS score.

What it is

IGEL OS before version 11 fails to properly verify a cryptographic signature in the igel-flash-driver module, allowing Secure Boot to be bypassed. A crafted root filesystem can then be mounted from an unverified SquashFS image, undermining the boot chain integrity that Secure Boot is meant to enforce.

Impact

An attacker with physical access can boot a tampered root filesystem, gaining control of the OS environment and defeating Secure Boot protections. The CVSS vector indicates a high availability impact with no confidentiality or integrity impact scored, though the practical effect is a full boot-chain compromise.

Attack surface

The vulnerability is reached physically (AV:P) with no authentication or user interaction required. An attacker must have local, physical access to the device to supply the crafted SquashFS image during boot.

Exploitation

CVE-2025-47827 is listed in CISA KEV (added 2025-10-14, due 2025-11-04) and public exploit code is referenced on GitHub. EPSS 30-day probability is about 4.9 percent (91.7th percentile), and CISA notes no known ransomware campaign use.

What to do

• Upgrade IGEL OS to version 11 or later, which fixes the signature verification flaw.
• If patching is not immediately possible, apply vendor mitigations or discontinue use of affected devices per CISA BOD 22-01 guidance.
• Restrict physical access to IGEL endpoints and boot media to trusted personnel.
• Enable and monitor firmware-level controls that detect or block unsigned boot images where supported.
• Track the CISA KEV due date (2025-11-04) and confirm remediation status for all exposed devices.

Detection

• Monitor for unexpected or modified SquashFS images or boot artifacts on IGEL OS devices.
• Audit physical access logs and boot events for anomalies on IGEL endpoints.
• Check IGEL OS version inventory to identify devices still running versions before 11.
• Review endpoint telemetry for signs of tampered root filesystem mounts or boot-chain modifications.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.