IGEL OS EUVD-2026-67962

Physical presence at the target device is the hard prerequisite - remote or network-based exploitation is not possible. The attacker must be able to place a file named igel.conf (which may be entirely empty and unsigned) on any storage partition readable by GRUB at boot time, most easily achieved via a USB storage device. No credentials, no prior access, and no special software configuration on the target are required - the fail-open behavior is present in default configurations of all affected IGEL OS versions. Exploitation is bounded to IGEL OS 12 before 12.9.0/12.8.3 LTS and IGEL OS 11 before 11.11.150; patched versions are not affected. Physical security controls (locked enclosures, cable locks, BIOS USB lockdown) are the primary mitigating factors for unpatched devices; BIOS USB lockdown reduces the removable-media delivery path but is not a complete fix if internal storage is accessible.

The CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) precisely captures the threat profile: physical presence is a hard prerequisite, but within that constraint, exploitation is trivially low complexity - no credentials, no toolchain, just an empty file on storage media and a reboot. For organizations running thin client fleets such as healthcare kiosks, point-of-sale terminals, or branch office endpoints, physical access to unattended devices is a realistic and recurring threat scenario, making AV:P considerably less reassuring than it would be for rack-mounted server infrastructure. No CISA KEV listing and no EPSS data were available in the provided input, so exploitation probability cannot be quantified; however, the DEF CON 34 presentation and the AmberWolf blog post mean the full technique is publicly documented, materially lowering the skill bar for potential attackers. The TPM PCR bypass is the most significant risk amplifier: organizations relying on attestation as their primary integrity monitoring control have no automated tripwire for this attack. CVSS correctly indicates no availability impact (VA:N), consistent with the description - the attacker gains privileged access but does not disrupt device operation. Vendor-released patches are confirmed available (ISN-2026-20), making remediation straightforward for organizations with centrally managed update infrastructure.

An attacker with brief unsupervised physical access to an IGEL thin client - such as a healthcare workstation left unattended or a kiosk in a semi-public area - inserts a USB drive containing an empty file named igel.conf and reboots the device. GRUB encounters the unsigned file and, due to its fail-open verification logic, presents an interactive GRUB prompt rather than refusing to continue. The attacker appends kernel parameters such as init=/bin/sh or single to the boot command, gaining a root shell with full read-write access to the unlocked disk, while TPM PCR values remain unaltered and produce no attestation alert in downstream monitoring systems. The complete technique, including cross-vendor applicability across multiple thin client brands, was presented publicly at DEF CON 34.