CVE-2025-47827

MediumCVSS 4.6/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published
Jun 5, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Oct 14, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-478286.4Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.CVE-2025-47835.4The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML attributes of the CountdowCVE-2025-47849.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL InjectionCVE-2025-478498.8A privilege escalation vulnerability exists in Apache CloudStack versions 4.10.0.0 through 4.20.0.0 where a malicious Domain Admin user in tCVE-2025-47859.8A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknCVE-2025-478505.3In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloningCVE-2025-478515.4In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleCVE-2025-478525.4In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possibleCVE-2025-478535.4In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possibleCVE-2025-478546.1In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root pageCVE-2025-478559.8An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3CVE-2025-478567.2Two improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in Fortinet FortiVoi