IGEL OS CVE-2026-82017

Physical access to the IGEL OS device is required - this is confirmed by AV:P in the CVSS 4.0 vector and is the hard prerequisite. The attacker must be able to write to the boot registry storage area, which means either direct storage access (removing the drive or booting from external media) or sufficient OS-level access to mount and modify the partition. No authentication within IGEL OS is required (PR:N) because the write target is the unencrypted configuration area accessible outside the running OS. The vulnerability exists in any default deployment of the affected versions, as the boot registry is unencrypted and unsigned by design in unpatched releases. Exploitation is limited to: physical presence at or direct hardware access to the device; targeting only IGEL OS 12 before 12.7.6 or IGEL OS 11 before 11.11.150. Remote exploitation is not possible. The absence of TPM PCR alerting removes a key detection control, but physical access remains the mandatory entry condition.

The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) scores 8.6, which is appropriate: the impact metrics are severe, reflecting full control over the boot environment and likely access to encrypted data. However, AV:P (physical access) is the decisive limiter - this is not a remotely exploitable vulnerability. Real-world risk is primarily relevant in environments where thin clients are deployed in accessible locations: hospital wards, bank branches, open-plan call centers, retail kiosks, or shared workstations in hotels and airports. In such deployments, the risk is elevated well above what a raw CVSS score might imply, because the attacker population includes insider threats, physical intruders, and service technicians. The critical threat model here is full-disk encryption bypass: the DEF CON 34 presentation title explicitly references bypassing FDE, and kernel parameter injection can be used to load a custom init, disable dm-crypt, or pass custom module parameters - all without the TPM raising an alarm. No EPSS data was provided in the input; EPSS cannot be estimated here without it. There is no CISA KEV listing, and no evidence of active exploitation at scale, but the public POC script (inject_bootreg.py) significantly lowers the bar for exploitation by any motivated actor with physical access.

An attacker with brief physical access to an unpatched IGEL thin client - for example, a malicious insider at a hospital workstation or an attacker who bypasses physical security during off-hours - removes or accesses the device's storage and uses the publicly available inject_bootreg.py script (https://github.com/AmberWolfCyber/DEFCON34-ThinClientThinCrypto) to write malicious kernel parameters into the unencrypted boot registry partition. On next boot, the signed bootloader reads the tampered configuration and passes the injected parameters to the Linux kernel, which executes them with boot-environment privileges. Because the measured boot code itself is unmodified, the TPM does not register any PCR measurement change, allowing the attacker to potentially decrypt full-disk-encrypted storage or establish persistent access without triggering integrity alarms.