Medium severity · published Jun 5, 2025
CVE-2025-47827
IGEL OS Use of a Key Past its Expiration Date Vulnerability
In wildKEV
4.6
CVSS
4.9%
EPSS
Yes
On KEV
Description
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.9% · higher than 92% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 14, 2025
Federal remediation dueNov 4, 2025
Ransomware campaign useNot known
Affected products
Which versions
IO
Igel OS · Igel
before 11.01.100 · source: NVD, KEV
W1
Windows 10 1507 · Microsoft
before 10.0.10240.21161; before 10.0.10240.21161 · source: NVD
W1
Windows 10 1607 · Microsoft
before 10.0.14393.8519; before 10.0.14393.8519 · source: NVD
W1
Windows 10 1809 · Microsoft
before 10.0.17763.7919; before 10.0.17763.7919 · source: NVD
W1
Windows 10 21h2 · Microsoft
before 10.0.19044.6456 · source: NVD
W1
Windows 10 22h2 · Microsoft
before 10.0.19045.6456 · source: NVD
W1
Windows 11 22h2 · Microsoft
before 10.0.22621.6060 · source: NVD
W1
Windows 11 23h2 · Microsoft
before 10.0.22631.6060 · source: NVD
W1
Windows 11 24h2 · Microsoft
before 10.0.26100.6899 · source: NVD
W1
Windows 11 25h2 · Microsoft
before 10.0.26200.6899 · source: NVD
WS
Windows Server 2012 · Microsoft
r2 · source: NVD
WS
Windows Server 2016 · Microsoft
before 10.0.14393.8519 · source: NVD
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-47827: IGEL IGEL OS - IGEL OS Use of a Key Past its Expiration Date Vulnerability
IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
IOIGEL OSCVE-2025-47827
Oct 14, 2025·CISA KEV