# CVE-2025-47827: IGEL OS Secure Boot bypass in igel-flash-driver

Source: https://junglewise.ai/threats/cve-2025-47827-igel-os-secure-boot-bypass-in-igel-flash-driver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-14. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-47827 · Severity: critical · CVSS 4.6 · Exploited in the wild · Published 2025-10-14

IGEL OS, an operating system used for thin clients and secure endpoints, contains a vulnerability that allows an attacker to bypass Secure Boot protections. By exploiting a flaw in how the system verifies digital signatures, an attacker with physical access can load a malicious root filesystem. This could allow for the persistent compromise of the device, bypassing the security measures intended to ensure only trusted software runs on the hardware.

## Quick answers

**Is CVE-2025-47827 exploited in the wild?** Yes. CVE-2025-47827 is known to be exploited in the wild, first recorded on 14 October 2025. Treat it as urgent.

**How severe is CVE-2025-47827?** Critical severity, with a CVSS score of 4.6, published 14 October 2025.

**Which products and versions are affected?** IGEL IGEL OS before 11.01.100.

**Is there a fix for CVE-2025-47827?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-47827 attacked?** It is attacked with physical access, in an operating system.

**Am I affected by CVE-2025-47827?** Check whether you run IGEL OS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in the igel-flash-driver module of IGEL OS (versions prior to 11.01.100) stems from the improper verification of cryptographic signatures, specifically the use of a key past its expiration date (CWE-347). An attacker with physical access can exploit this to bypass Secure Boot mechanisms. By providing a crafted, unverified SquashFS image, the attacker can force the system to mount a malicious root filesystem. This vulnerability has been observed in the wild and is tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

## Affected products

- IGEL IGEL OS before 11.01.100

## Timeline

- 2025-06-05: disclosed: Initial CVE assignment and description provided by MITRE
- 2025-10-14: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog
- 2025-10-14: advisory: NVD published the vulnerability details