IGEL OS up to 12.7.5/11.11.149 Boot Registry injection

Summaryinfo

A vulnerability identified as very critical has been detected in IGEL OS up to 12.7.5/11.11.149. This affects an unknown function of the component Boot Registry. The manipulation leads to injection. This vulnerability is referenced as CVE-2026-82017. The attack can only be performed from a local environment. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in IGEL OS up to 12.7.5/11.11.149. This issue affects some unknown functionality of the component Boot Registry. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.

The advisory is shared at kb.igel.com. The identification of this vulnerability is CVE-2026-82017 since 08/27/2026. The exploitation is known to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/29/2026). MITRE ATT&CK project uses the attack technique T1055 for this issue.

Upgrading to version 12.7.6 or 11.11.150 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• IGEL

Name

• OS

Version

• 11.11.149
• 12.7.0
• 12.7.1
• 12.7.2
• 12.7.3
• 12.7.4
• 12.7.5

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion