Alpine iLX-F511 framework service 0-day allows unauthenticated RCE
Original title: ZDI-26-824: (0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability
Network-adjacent attackers need no login to call an exposed function; ZDI rates it CVSS 8.8.
ZDI-26-824 is a Pwn2Own zero-day in the Alpine iLX-F511 framework service that exposes a dangerous function. Network-adjacent attackers can execute arbitrary code without authentication. ZDI assigned CVSS 8.8, the highest score among these four notices. No CVE or patch version is given.
Unconfirmed: The notice does not confirm a fix or real-world exploitation.
- Authentication is not required.
- The advisory describes network-adjacent access, not internet-remote access.
- ZDI's CVSS rating is 8.8.
Impact: unauthenticated arbitrary code execution nearby
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
- Vendors
- Alpine
- Products
- Alpine iLX-F511
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.