Alpine iLX-F511 framework service overflow allows code execution
Original title: ZDI-26-822: (0Day) (Pwn2Own) Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability
ZDI rates the unauthenticated, physically triggered flaw 6.8 and labels it a Pwn2Own zero-day.
ZDI-26-822 is a stack-based buffer overflow in the Framework Service of Alpine iLX-F511 devices. A physically present attacker can run arbitrary code without authentication. ZDI assigned CVSS 6.8 and marked the issue a Pwn2Own zero-day. The snippet does not name affected firmware or a fix.
Unconfirmed: The advisory does not say whether a patch exists or whether the flaw is used outside Pwn2Own.
- The flaw is ZDI-26-822 in the Framework Service.
- Physical presence is required and authentication is not.
- ZDI's CVSS rating is 6.8.
- The advisory labels it a Pwn2Own zero-day.
Impact: Unauthenticated arbitrary code execution with physical access
| Product | Affected |
|---|---|
| Alpine iLX-F511 | — |
- Vendors
- Alpine
- Products
- iLX-F511
- Organizations
- Zero Day Initiative
From the original article
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.