Alpine iLX-F511 Android Auto handler overflow allows code execution
Original title: ZDI-26-827: (0Day) (Pwn2Own) Alpine iLX-F511 Android Auto Connection Handler Stack-based Buffer Overflow Remote Code Execution Vulnerability
Physically present attackers need no login; ZDI scores the Pwn2Own zero-day at 6.8.
ZDI-26-827 is a stack-based buffer overflow in the Android Auto Connection Handler on Alpine iLX-F511 devices. An attacker who is physically present can execute arbitrary code without authentication. ZDI assigned CVSS 6.8 and tagged the issue as a Pwn2Own zero-day. No affected version range or fixed release is stated.
Unconfirmed: No patch status or exploitation beyond the Pwn2Own label is stated.
- The advisory identifier is ZDI-26-827.
- The component is the Android Auto Connection Handler.
- Exploitation needs physical presence but not authentication.
- ZDI assigned a CVSS rating of 6.8.
Impact: Unauthenticated arbitrary code execution with physical access
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
- Vendors
- Alpine
- Products
- iLX-F511
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.