Igel vulnerabilities
We track 3 vulnerabilities in Igel products across 4 products. 2 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on August 28, 2026.
Latest Igel vulnerabilities
- 7.6 High severity
IGEL OS 12: Insufficient Verification of Data Authenticity
IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration a
- 4.6 Medium severity
IGEL OS Use of a Key Past its Expiration Date Exploited
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
- 8.8 High severity
Universal Management Suite: Use of Hard-coded Credentials
An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has discovered encrypted superuser credentials, to decrypt those credentials using a static 8-byte DES key