CVE-2025-47827

CVE-2025-47827 针对 CVE-2025-47827 的概念验证与漏洞报告。 目录 描述 披露 影响 检测 缓解措施 二进制文件 概念验证 资源 描述 在 v11 之前的 IGEL OS 中，Secure Boot 可被绕过，原因是 igel-flash-driver 模块未正确验证密码学签名。最终，一个精心构造的根文件系统可以从未经验证的 SquashFS 镜像中挂载。 IGEL OS 10 中 Linux 内核模块 igel-flash-driver 对密码学签名验证不当，允许恶意行为者通过启动由 Microsoft 第三方 UEFI CA 签名的 shim 来绕过...

EUVD-2026-67961

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...

EUVD-2026-67962

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit...

CVE-2026-82017

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...

CVE-2026-82018

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit...

CVE-2026-82018

IGEL OS 12 (before 12.9.0 / 12.8.3 LTS ) and IGEL OS 11 (before 11.11.150 ) contain a secure boot bypass in the GRUB boot stage . A physically present attacker can place an unsigned empty file named igel.conf on a partition, exploiting GRUB's fail-open signature verification behavior to reach an ...

CVE-2026-82018 IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit...

CVE-2026-82017 IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...

CVE-2026-82017

IGEL OS 12 (before 12.7.6 ) and 11 (before 11.11.150 ) are affected by a boot registry parameter injection vulnerability. The root cause is an unencrypted and unsigned configuration area that is read by the signed bootloader. An attacker with physical access can write malicious Linux kernel comma...

PT-2026-83365

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.7.6 IGEL OS 11 versions prior to 11.11.150 Description An issue exists where attackers with physical access can execute arbitrary Linux loader parameters. This is possible by writing to an unencrypted and unsign...

PT-2026-83366

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.9.0 IGEL OS 12 version 12.8.3 LTS IGEL OS 11 versions prior to 11.11.150 Description A secure boot bypass exists in the GRUB boot stage. A physically present attacker can gain unauthorized root access by placing...

IGEL OS < 11.0.0 Secure Boot bypass (CVE-2025-47827)

The version of IGEL OS running on the remote host is prior to version 11. It is, therefore, affected by a cryptographic signature verification vulnerability in the igel-flash-driver module. An attacker could exploit this flaw to bypass Secure Boot protections. By leveraging the improper...

📄 IGEL OS Workspace Edition 11.10.430 Privilege Escalation

IGEL OS Workspace Edition version 11.10.430 suffers from a privilege escalation vulnerability. This vulnerability demonstrates how architectural trust in custom configuration frameworks can be abused to establish long-term persistence, even on systems designed to be non-persistent and hardened by...

📄 IGEL OS Workspace Edition 11.10.430 Persistent Payload

IGEL OS Workspace Edition version 11.10.430 contains a persistence mechanism that allows authenticated attackers with root access to establish persistent code execution through the system's registry configuration. The vulnerability leverages IGEL OS's custom registry system and mount point...

Metasploit Wrap-Up 11/28/2025

This week, we have added 10 new modules to Metasploit Framework including an SMB to MSSQL relay module, a remote code execution module targeting Fortinet software, additional 32-bit and 64-bit RISC-V payloads, and more. The SMB to MSSQL NTLM relay module allows users to open MSSQL sessions and ru...

📄 IGEL OS Privilege Escalation

This Metasploit module escalates privileges for IGEL OS Workspace Edition sessions by modifying network-manager.service using setupcmd SUID and network and then restarting the service. This module requires Metasploit: https://metasploit.com/download Current source:...

Microsoft Patch Tuesday for October 2025 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for October 2025, addressing 175 Microsoft CVEs and 21 non-Microsoft CVEs. Among these, 17 vulnerabilities are considered critical and 11 are flagged as important and considered more likely to be exploited. Current intelligence shows that three o...

MITRE CVE-2025-47827: Secure Boot bypass in IGEL OS before 11

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image. MITRE created this CVE on their behalf. The documented Windows updates...

KB5066793: Windows 11 version 22H2 / Windows 11 version 23H2 Security Update (October 2025)

The remote Windows host is missing security update 5066793. It is, therefore, affected by multiple vulnerabilities - tifpredict.h and tifpredict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual til...

KB5066835: Windows 11 Version 24H2 / Windows Server 2025 / Windows 11 Version 25H2 Security Update (October 2025)

The remote Windows host is missing security update 5066835. It is, therefore, affected by multiple vulnerabilities - tifpredict.h and tifpredict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual til...