CVE-2025-47827

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-47827

4.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

References
Link Resource
https://github.com/Zedeldi/CVE-2025-47827 Exploit Third Party Advisory
https://github.com/Zedeldi/igelfs Product
https://github.com/Zedeldi/CVE-2025-47827 Exploit Third Party Advisory
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827 US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:o:igel:igel_os:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
History

05 Nov 2025, 19:26

Type Values Removed Values Added
References () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827 - () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827 - US Government Resource

21 Oct 2025, 23:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827 -

21 Oct 2025, 20:20

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:21

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-47827 -

15 Oct 2025, 16:55

Type Values Removed Values Added
First Time Microsoft windows 10 1809
Microsoft windows 10 1507
Microsoft windows 11 24h2
Microsoft windows Server 2019
Microsoft windows Server 2025
Microsoft windows 11 23h2
Microsoft windows 10 1607
Microsoft
Microsoft windows Server 2022 23h2
Igel
Microsoft windows 10 22h2
Microsoft windows 11 22h2
Igel igel Os
Microsoft windows 10 21h2
Microsoft windows 11 25h2
Microsoft windows Server 2016
Microsoft windows Server 2022
Microsoft windows Server 2012
References () https://github.com/Zedeldi/CVE-2025-47827 - () https://github.com/Zedeldi/CVE-2025-47827 - Exploit, Third Party Advisory
References () https://github.com/Zedeldi/igelfs - () https://github.com/Zedeldi/igelfs - Product
References () https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 - () https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 - Third Party Advisory
CPE cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*
cpe:2.3:o:igel:igel_os:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*

14 Oct 2025, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.4 		v2 : unknown
v3 : 4.6
References
  • () https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-47827 -

10 Jun 2025, 15:15

Type Values Removed Values Added
References () https://github.com/Zedeldi/CVE-2025-47827 - () https://github.com/Zedeldi/CVE-2025-47827 -
Summary
  • (es) En sistemas operativos IGEL anteriores a la versión 11, el arranque seguro se puede omitir porque el módulo igel-flash-driver verifica incorrectamente una firma criptográfica. En última instancia, se puede montar un sistema de archivos root manipulados desde una imagen de SquashFS sin verificar.
CWE CWE-347
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.4

05 Jun 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-05 14:15

Updated : 2025-11-05 19:26

NVD link : CVE-2025-47827

Mitre link : CVE-2025-47827

CVE.ORG link : CVE-2025-47827

JSON object : View

Products Affected

microsoft

igel

CWE
CWE-347

Improper Verification of Cryptographic Signature