Alpine iLX-F511 diagapp 0-day allows local command injection
Original title: ZDI-26-825: (0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability
A physically present attacker needs no authentication; ZDI rates the Pwn2Own flaw CVSS 6.8.
ZDI-26-825 describes a command-injection zero-day in diagapp on Alpine iLX-F511, disclosed from Pwn2Own. Physically present attackers can execute arbitrary code without authentication. ZDI assigned CVSS 6.8. The advisory gives no CVE or fixed version.
Unconfirmed: Whether a vendor fix exists is not stated in the notice.
- Exploitation requires physical presence rather than network access.
- Authentication is not required.
- ZDI's CVSS rating is 6.8.
Impact: arbitrary code execution with physical access
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
- Vendors
- Alpine
- Products
- Alpine iLX-F511diagapp
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.