CVE-2025-47827
IGEL OS Use of a Key Past its Expiration Date Vulnerability
Description
CVE-2025-47827 is a medium-severity vulnerability in IGEL OS before version 11 that allows Secure Boot bypass through improper verification of a cryptographic signature in the igel-flash-driver module. An attacker with physical access to the device can mount a crafted root filesystem from an unverified SquashFS image, undermining the chain of trust established by Secure Boot. With a CVSS v3.1 base score of 4.6, an EPSS score of 1.15% (78.2nd percentile), and inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 4, 2025, this vulnerability requires attention from organizations relying on IGEL thin clients in their infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| igel | igel os | < 11.01.100 |
| microsoft | windows 10 1507 | < 10.0.10240.21161 |
| microsoft | windows 10 1607 | < 10.0.14393.8519 |
| microsoft | windows 10 1809 | < 10.0.17763.7919 |
| microsoft | windows 10 21h2 | < 10.0.19044.6456 |
| microsoft | windows 10 22h2 | < 10.0.19045.6456 |
| microsoft | windows 11 22h2 | < 10.0.22621.6060 |
| microsoft | windows 11 23h2 | < 10.0.22631.6060 |
| microsoft | windows 11 24h2 | < 10.0.26100.6899 |
| microsoft | windows 11 25h2 | < 10.0.26200.6899 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8519 |
| microsoft | windows server 2019 | < 10.0.17763.7919 |
| microsoft | windows server 2022 | < 10.0.20348.4294 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.1913 |
| microsoft | windows server 2025 | < 10.0.26100.6899 |
References
- https://github.com/Zedeldi/CVE-2025-47827(Exploit, Third Party Advisory)
- https://github.com/Zedeldi/igelfs(Product)
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827(US Government Resource)
Weakness Type
CWE-347: Improper Verification of Cryptographic Signature
CWE-347 describes a weakness where software does not properly verify the cryptographic signature of data before processing it, allowing an attacker to substitute malicious data that appears to be authentic. In CVE-2025-47827, the igel-flash-driver module in IGEL OS fails to properly verify the cryptographic signature of the root filesystem image, allowing an attacker to replace the legitimate SquashFS image with a crafted one that contains malicious code. This bypasses the Secure Boot chain of trust that is designed to ensure only verified software runs on the device.
Impact Analysis
The business impact of CVE-2025-47827 is primarily focused on availability disruption through physical access. Confidentiality and integrity are not directly rated as impacted in the CVSS base score (both rated None), though in practice, mounting a malicious root filesystem could provide the attacker with access to device data and the ability to modify the system. Availability impact is rated high because Secure Boot bypass allows an attacker to replace the trusted operating system with a malicious one, completely compromising the device's intended function.
The EPSS score of 1.15% (78.2nd percentile) indicates moderate exploitation probability. The physical access requirement (Attack Vector: Physical) significantly limits the attack surface, as the attacker must have hands-on access to the IGEL device. However, IGEL thin clients are commonly deployed in shared office environments, kiosks, healthcare facilities, and public-facing locations where physical access may not be tightly controlled. Organizations using IGEL devices in these scenarios face the risk of an attacker deploying a compromised operating system that could capture credentials, exfiltrate data, or serve as a persistent foothold in the network. The ransomware association is listed as unknown.
Exploit Maturity
CVE-2025-47827 has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 4, 2025, confirming exploitation activity. The EPSS score of 1.15% (78.2nd percentile) indicates moderate exploitation probability. A public exploit and supporting tools have been published on GitHub by the researcher Zedeldi, along with an IGEL filesystem analysis tool (igelfs) that provides the technical foundation for understanding and exploiting the vulnerability. The availability of these tools lowers the barrier for exploitation by anyone with physical access to an IGEL device. The ransomware usage status is unknown, and the physical access requirement makes large-scale automated exploitation unlikely, though targeted attacks against specific IGEL deployments are feasible.
Remediation
- Update IGEL OS to version 11.01.100 or later. The vulnerability is fixed in IGEL OS version 11 and above. Deploy the updated firmware to all managed IGEL devices through the IGEL Universal Management Suite (UMS) or your preferred endpoint management platform.
- Enforce physical security for IGEL devices. Ensure IGEL thin clients are physically secured in locked enclosures, server rooms, or areas with restricted access. This is the most effective immediate mitigation for the physical access attack vector.
- Enable BIOS/UEFI password protection. Configure BIOS or UEFI passwords on IGEL devices to prevent unauthorized changes to boot settings that could facilitate the Secure Boot bypass.
- Audit device boot integrity. Implement monitoring to detect IGEL devices that boot from unexpected or modified firmware images. Review management console alerts for devices reporting unexpected OS versions or configuration changes.
- Review deployment locations for physical access risk. Assess which IGEL devices are in locations where physical access by unauthorized persons is possible (reception areas, meeting rooms, healthcare stations) and prioritize firmware updates for those devices.
Technical Details
The CVSS v3.1 base score for CVE-2025-47827 is 4.6 (Medium) with the vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Attack Vector (AV:P) indicates physical access to the device is required, which is the most restrictive attack vector category. Attack Complexity (AC:L) means the attack is straightforward once physical access is obtained. Privileges Required (PR:N) confirms no software-level authentication is needed. User Interaction (UI:N) means no user action is needed. Scope (S:U) is unchanged. Confidentiality (C:N) and Integrity (I:N) are rated as not impacted, while Availability (A:H) is high, reflecting the Secure Boot bypass that compromises the device's trusted boot chain.
The vulnerability exists in the igel-flash-driver kernel module, which is responsible for reading and mounting the root filesystem stored as a SquashFS image on the IGEL device's flash storage. During the boot process, the module should verify the cryptographic signature of the SquashFS image to ensure it has not been tampered with, maintaining the Secure Boot chain of trust from UEFI firmware through the operating system. However, the signature verification in the igel-flash-driver is improperly implemented, failing to reject images with invalid or missing signatures. An attacker with physical access can replace the legitimate SquashFS image on the device's storage with a crafted one containing a modified root filesystem. When the device boots, the igel-flash-driver loads and mounts the malicious image without detecting the signature failure, giving the attacker full control over the operating system running on the device.
Frequently Asked Questions
What is CVE-2025-47827?
CVE-2025-47827 is a Secure Boot bypass vulnerability in IGEL OS before version 11. The igel-flash-driver module fails to properly verify the cryptographic signature of the root filesystem image, allowing an attacker with physical access to mount a crafted SquashFS image containing a malicious operating system.
Can CVE-2025-47827 be exploited remotely?
No. The vulnerability requires physical access to the IGEL device (CVSS Attack Vector: Physical). An attacker must be able to physically interact with the device to replace the root filesystem image on its storage. This significantly limits the attack surface but does not eliminate the risk in environments where IGEL devices are in accessible locations.
What is the risk if Secure Boot is bypassed on an IGEL device?
If Secure Boot is bypassed, an attacker can run a completely modified operating system on the device. This malicious OS could capture user credentials, intercept VDI sessions, exfiltrate data, or serve as a persistent entry point into the corporate network. The device would appear to function normally while operating under the attacker's control.
Are IGEL OS 11 devices affected?
IGEL OS versions before 11.01.100 are affected. Organizations running IGEL OS 11 with the latest updates should verify they are on version 11.01.100 or later. The fix addresses the cryptographic signature verification in the igel-flash-driver module to properly validate the root filesystem image before mounting.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.