IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code.

IGEL OS versions 12 before 12.7.6 and 11 before 11.11.150 contain a boot registry parameter injection vulnerability. Attackers with physical access can write malicious kernel command line parameters to an unencrypted and unsigned configuration area that is read by the signed bootloader. The injected parameters execute with boot environment privileges. Critically, the attack bypasses TPM PCR measurement checks because it does not modify the measured boot code itself. This effectively undermines Secure Boot and full-disk encryption protections on affected thin client devices. The vulnerability was publicly disclosed at DEF CON 34 as part of research into thin client cryptographic weaknesses. A proof-of-concept exploit script has been published on GitHub. IGEL has issued a security advisory (ISN-2026-19) and released patched versions of both OS branches.