---
id: "CVE-2026-118601"
kind: "vulnerability"
aliases: ["CVE-2026-118601"]
title: "Alpine iLX-F511 head unit: hard-coded SSH credentials allow remote code execution"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["alpine-ilx-f511", "embedded", "infrastructure", "iot"]
not_affected_if: ["no-ssh-exposure"]
published_at: "2026-10-28T17:18:27+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:34:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118601", "first_seen_at": "2026-10-28T17:34:09+00:00"}]
---

# Alpine iLX-F511 head unit: hard-coded SSH credentials allow remote code execution

Alpine iLX-F511 devices ship with hard-coded SSH credentials, so anyone who knows them can log in over SSH. An attacker who connects to the SSH service can run code as the telechips user on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118601

## From the sources

Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the SSH service. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to execute code in the context of the telechips user. Was ZDI-CAN-29013.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_