{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-82017",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-82017",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-28T21:09:01.253Z",
    "updatedAt": "2026-10-01T15:21:40.174Z",
    "importedAt": "2026-10-24T01:58:30.346Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "IGEL OS 12 / 11 Boot Registry Parameter Injection via Unsigned Configuration Area",
      "summary": "IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.",
      "affected": [
        {
          "vendor": "IGEL",
          "product": "IGEL OS 12",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "12.0.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "12.7.6"
            }
          ]
        },
        {
          "vendor": "IGEL",
          "product": "IGEL OS 11",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "11.0.0",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "11.11.150"
            }
          ]
        }
      ]
    }
  }
}