CVE-2025-47827

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-47827
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Zedeldi/CVE-2025-47827 Exploit Third Party Advisory
https://github.com/Zedeldi/igelfs Product
https://github.com/Zedeldi/CVE-2025-47827 Exploit Third Party Advisory
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827
Configurations

Configuration 1 (hide)

cpe:2.3:o:igel:igel_os:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
History

21 Oct 2025, 23:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827 -

15 Oct 2025, 16:55

Type Values Removed Values Added
References () https://github.com/Zedeldi/CVE-2025-47827 - () https://github.com/Zedeldi/CVE-2025-47827 - Exploit, Third Party Advisory
References () https://github.com/Zedeldi/igelfs - () https://github.com/Zedeldi/igelfs - Product
References () https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 - () https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 - Third Party Advisory
First Time Microsoft windows Server 2022
Microsoft windows 11 24h2
Igel igel Os
Microsoft windows 10 21h2
Microsoft windows 10 22h2
Microsoft
Microsoft windows 10 1607
Microsoft windows 11 22h2
Microsoft windows 11 25h2
Microsoft windows Server 2019
Microsoft windows Server 2022 23h2
Microsoft windows 10 1507
Igel
Microsoft windows Server 2016
Microsoft windows Server 2012
Microsoft windows 11 23h2
Microsoft windows 10 1809
Microsoft windows Server 2025
CPE cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
cpe:2.3:o:igel:igel_os:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*

14 Oct 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.4 		v2 : unknown
v3 : 4.6
References
  • () https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 -

10 Jun 2025, 15:15

Type Values Removed Values Added
CWE CWE-347
Summary
  • (es) En sistemas operativos IGEL anteriores a la versión 11, el arranque seguro se puede omitir porque el módulo igel-flash-driver verifica incorrectamente una firma criptográfica. En última instancia, se puede montar un sistema de archivos root manipulados desde una imagen de SquashFS sin verificar.
References () https://github.com/Zedeldi/CVE-2025-47827 - () https://github.com/Zedeldi/CVE-2025-47827 -
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.4

05 Jun 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-05 14:15

Updated : 2025-10-21 23:17

NVD link : CVE-2025-47827

Mitre link : CVE-2025-47827

CVE.ORG link : CVE-2025-47827

JSON object : View

Products Affected

microsoft

  • windows_10_1809
  • windows_server_2022_23h2
  • windows_11_23h2
  • windows_10_22h2
  • windows_10_21h2
  • windows_server_2012
  • windows_server_2022
  • windows_server_2025
  • windows_server_2019
  • windows_11_24h2
  • windows_10_1607
  • windows_11_22h2
  • windows_server_2016
  • windows_11_25h2
  • windows_10_1507

igel

  • igel_os
CWE
CWE-347

Improper Verification of Cryptographic Signature