Alpine iLX-F511 zero-day exposes hard-coded SSH credentials for code execution
Original title: ZDI-26-819: (0Day) (Pwn2Own) Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability
Network-adjacent attackers need no login; ZDI rates ZDI-26-819 at CVSS 6.3 after a Pwn2Own finding.
ZDI published ZDI-26-819, labeled a zero-day and tied to Pwn2Own, in Alpine iLX-F511 devices. Network-adjacent attackers can execute arbitrary code without authentication through hard-coded SSH credentials. ZDI assigned CVSS 6.3. The advisory lists no affected versions, fix, or CVE.
Unconfirmed: Affected versions, a fix, and a CVE are not stated.
- ZDI-26-819 is marked 0Day and Pwn2Own.
- Authentication is not required.
- Attackers must be network-adjacent.
- ZDI CVSS score is 6.3.
Impact: unauthenticated network-adjacent arbitrary code execution
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
- Vendors
- Alpine
- Products
- iLX-F511
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.