⚠ Actively exploited
Added to CISA KEV on 2025-10-14. Federal agencies required to patch by 2025-11-04. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2025-47827 — Improper Verification of Cryptographic Signature in OS
Severity
4.6MEDIUMNVD
EPSS
1.4%
top 19.54%
CISA KEV
KEV
Added 2025-10-14
Due 2025-11-04
Exploit
No known exploits
Affected products
Timeline
PublishedJun 5
KEV addedOct 14
KEV dueNov 4
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6
Affected Packages11 packages
🔴Vulnerability Details
3GHSA▶
GHSA-pww7-j9v6-xc6j: In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature↗2025-06-05
CVEList▶
CVE-2025-47827: In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature↗2025-06-05