{"id":"CVE-2026-118601","kind":"vulnerability","aliases":["CVE-2026-118601"],"related":[],"title":"Alpine iLX-F511 head unit: hard-coded SSH credentials allow remote code execution","description":"Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the SSH service. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to execute code in the context of the telechips user. Was ZDI-CAN-29013.","summary":"Alpine iLX-F511 devices ship with hard-coded SSH credentials, so anyone who knows them can log in over SSH. An attacker who connects to the SSH service can run code as the telechips user on the device.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alpine-ilx-f511","embedded","infrastructure","iot"],"not_affected_if":["no-ssh-exposure"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:36+00:00","updated_at":"2026-10-28T17:34:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T17:34:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Alpine iLX-F511 head unit: hard-coded SSH credentials allow remote code execution","impact":"high","summary":"Alpine iLX-F511 devices ship with hard-coded SSH credentials, so anyone who knows them can log in over SSH. An attacker who connects to the SSH service can run code as the telechips user on the device.","category":"infrastructure","nicknames":[],"who_cares":["alpine-ilx-f511","embedded","iot"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code as the telechips user on the device.","analyst_note":"Find the vendor advisory or ZDI-CAN-29013 page for affected firmware versions, fixed versions, and whether SSH can be disabled.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ssh-exposure"],"who_is_affected":"Owners of Alpine iLX-F511 devices with the SSH service reachable from the local network. The sources do not describe firmware versions, so unknown whether a firmware update removes the credentials. Teams with no Alpine iLX-F511 units can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000565,"input_tokens":3398,"output_tokens":450,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118601':18A,21A '-2026':17A,20A '29013':149C 'adjac':87C 'affect':94C 'allow':12A,84C 'alpin':1A,23B,29B,69C,97C 'alpine-ilx-f511':22B 'anyon':42B 'arbitrari':91C 'attack':52B,88C,130C 'authent':102C 'code':9A,14A,38B,61B,76C,79C,92C,127C,137C 'connect':54B 'context':140C 'credenti':11A,40B,77C,128C 'cve':16A,19A 'devic':33B,68B,101C 'embed':26B 'execut':15A,80C,90C,136C 'exist':113C 'exploit':107C 'f511':4A,25B,32B,72C,100C 'flaw':112C 'hard':8A,37B,75C,126C 'hard-cod':7A,36B,74C,125C 'head':5A 'ilx':3A,24B,31B,71C,99C 'ilx-f511':2A,30B,70C,98C 'infrastructur':27B 'instal':95C 'iot':28B 'issu':119C 'know':44B 'leverag':132C 'log':47B 'network':86C 'network-adjac':85C 'remot':13A,78C 'requir':105C 'result':120C 'run':60B 'servic':58B,117C 'ship':34B 'specif':111C 'ssh':10A,39B,50B,57B,73C,116C 'telechip':64B,143C 'unit':6A 'use':123C 'user':65B,144C 'vulner':81C,83C,109C,134C 'within':114C 'zdi':147C 'zdi-can':146C","nicknames":[],"mitigations":[],"who_affected":"Owners of Alpine iLX-F511 devices with the SSH service reachable from the local network. The sources do not describe firmware versions, so unknown whether a firmware update removes the credentials. Teams with no Alpine iLX-F511 units can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118601","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118601","severity":null,"published_at":"2026-10-28T17:18:27+00:00","modified_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}