Alpine iLX-F511 vCard parser 0-day allows Bluetooth RCE
Original title: ZDI-26-821: (0Day) (Pwn2Own) Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
A network-adjacent attacker needs the unit to connect to a malicious Bluetooth device; ZDI rates it CVSS 8.0.
ZDI published ZDI-26-821, a Pwn2Own zero-day stack-based buffer overflow in vCard parsing on Alpine iLX-F511 devices. Network-adjacent attackers can execute arbitrary code if the target connects to a malicious Bluetooth device. ZDI assigned CVSS 8.0. The notice states no CVE or fixed version.
Unconfirmed: The advisory does not say whether a patch exists or attacks are occurring.
- User interaction is required to connect to a malicious Bluetooth device.
- ZDI labels the flaw a Pwn2Own zero-day.
- No firmware range, patch, or CVE is stated.
Impact: arbitrary code execution on the head unit
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
- Vendors
- Alpine
- Products
- Alpine iLX-F511
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The ZDI has assigned a CVSS rating of 8.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.