EUVD-2026-67962
GHSA-7c38-49cx-fjvw
Severity by source
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Physical access required (AV:P), no credentials needed (PR:N), scope change as GRUB compromise yields full OS-level root shell (S:C), with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered.
AnalysisAI
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Physical presence at the target device is the hard prerequisite - remote or network-based exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) precisely captures the threat profile: physical presence is a hard prerequisite, but within that constraint, exploitation is trivially low complexity - no credentials, no toolchain, just an empty file on storage media and a reboot. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to IGEL OS 12.9.0 or IGEL OS 12.8.3 LTS (or later) for OS 12 deployments, and IGEL OS 11.11.150 (or later) for OS 11 deployments, per vendor advisory ISN-2026-20 at https://kb.igel.com/en/security-safety/current/isn-2026-20-grub-shell-escape-in-igel-os. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Igel Os 12
View allSame weakness CWE-636 – Not Failing Securely ('Failing Open')
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today