A high-severity boot registry injection vulnerability in IGEL OS allows physically present attackers to execute arbitrary kernel parameters and achieve unauthorized system control.

The vulnerability exists due to insufficient verification of data authenticity within the boot registry. An unauthenticated attacker with physical access can modify an unsigned and unencrypted configuration area, which the signed bootloader subsequently processes, allowing for the injection of malicious kernel command line parameters.

Successful exploitation grants an attacker the ability to manipulate the boot environment and execute arbitrary code with elevated privileges. This bypasses standard system security, potentially leading to complete device compromise, unauthorized data access, or the deployment of persistent malicious software. Given the CVSS score of 7.6, this flaw represents a significant risk to organizations relying on IGEL thin clients for secure remote access.

Immediate Action: Update affected IGEL OS 12 installations to version 12.7.6 or later, and IGEL OS 11 installations to version 11.11.150 or later.

Proactive Monitoring: Audit physical access controls for all thin client deployments and monitor system boot logs for unauthorized modifications to kernel parameters.

Compensating Controls: Implement physical security measures such as locking chassis or using port blockers to prevent the connection of unauthorized boot media, which is a prerequisite for this attack.

Public Exploit Available: Yes, a proof of concept script is available via the AmberWolfCyber GitHub repository.

The risk posed by CVE-2026-82017 is significant due to the potential for complete system compromise. IT administrators should prioritize patching all vulnerable IGEL OS endpoints immediately. In environments where physical access cannot be strictly controlled, applying these updates is the primary defense against this vector.