Igel
Monthly
Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale.
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Boot registry parameter injection in IGEL OS 12 (before 12.7.6) and IGEL OS 11 (before 11.11.150) allows an attacker with physical access to execute arbitrary Linux kernel command-line parameters by writing to an unencrypted, unsigned configuration partition that the signed bootloader reads at startup. The attack is particularly dangerous because it does not alter the measured boot code path, meaning TPM PCR attestation does not detect the tampering - effectively defeating the trust assumptions of the secure boot and full-disk encryption stack. A publicly available exploit script and a DEF CON 34 presentation detail the technique; no CISA KEV listing has been issued at time of analysis, indicating exploitation has not been confirmed at scale.
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
Secure boot bypass in IGEL OS 12 (before 12.9.0/12.8.3 LTS) and IGEL OS 11 (before 11.11.150) allows physically present attackers to obtain a root shell by exploiting GRUB's fail-open signature verification behavior. Placing an empty, unsigned file named igel.conf on any GRUB-accessible partition causes the bootloader to drop into an interactive GRUB prompt instead of halting, from which the attacker boots the device's own kernel with attacker-controlled command-line arguments, unlocking the disk. The attack leaves TPM PCR values unaltered - defeating attestation-based detection - and was publicly detailed at DEF CON 34; no active exploitation confirmed in CISA KEV at time of analysis.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.