{"id":"CVE-2026-118602","kind":"vulnerability","aliases":["CVE-2026-118602"],"related":[],"title":"Alpine iLX-F511 head unit: local user escalates to root via Fiv service","description":"Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Fiv service. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29095.","summary":"The Fiv service on the Alpine iLX-F511 exposes a dangerous method that a local low-privileged user can call. An attacker who already runs code on the device can escalate to root and execute arbitrary code.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"iLX-F511","fixed":[],"affected":"all firmware versions; no range published (unknown)","ecosystem":"hardware"}],"ecosystems":[],"tags":["0day","alpine","automotive-head-unit","embedded","ilx-f511","infrastructure","local-privilege-escalation","pwn2own"],"not_affected_if":["other-hardware"],"how_to_check":"On the unit: HOME > Setup > System > About to read the firmware version (per Alpine's firmware readme). Every iLX-F511 is presumed affected; the advisory lists no version range.","fix":"No vendor fix as of 2026-10-28 (ZDI published as 0-day). Check Alpine support for a firmware newer than your current one; no fixed version known.","status":"open","published_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:26+00:00","updated_at":"2026-10-28T17:35:12+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-28T17:34:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Alpine iLX-F511 head unit: local user escalates to root via Fiv service","impact":"high","summary":"The Fiv service on the Alpine iLX-F511 exposes a dangerous method that a local low-privileged user can call. An attacker who already runs code on the device can escalate to root and execute arbitrary code.","category":"infrastructure","nicknames":[],"who_cares":["alpine","ilx-f511","embedded","automotive-head-unit"],"confidence":0.7,"needs_auth":"yes","worst_case":"local attacker gains root and runs arbitrary code on the device","analyst_note":"Find the affected firmware versions and the vendor fix from the ZDI advisory (ZDI-CAN-29095) or the NVD entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-hardware"],"who_is_affected":"Owners of Alpine iLX-F511 units with the Fiv.System service present. The attacker must already be able to run low-privileged code on the device, so remote-only exposure is not described in the sources. Teams without this hardware can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000559,"input_tokens":3424,"output_tokens":434,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected firmware versions and the vendor fix from the ZDI advisory (ZDI-CAN-29095) or the NVD entry.","search":"'-118602':17A,20A '-2026':16A,19A '0day':24B '29095':168C 'abil':113C 'affect':100C 'allow':93C 'alpin':1A,25B,45B,79C,103C 'alreadi':65B 'arbitrari':77B,157C 'attack':63B,95C,108C,147C 'automot':27B 'automotive-head-unit':26B 'call':61B 'code':67B,78B,119C,158C 'context':161C 'cve':15A,18A 'danger':51B,85C,144C 'devic':70B 'embed':30B 'escal':9A,38B,72B,89C,97C,153C 'execut':76B,115C,156C 'exist':133C 'exploit':127C 'expos':49B,84C,143C 'f511':4A,23A,33B,48B,82C,106C 'first':110C 'fiv':13A,41B,136C 'fiv.system':83C 'flaw':132C 'head':5A,28B 'ilx':3A,22A,32B,47B,81C,105C 'ilx-f511':2A,21A,31B,46B,80C,104C 'infrastructur':34B 'instal':101C 'issu':139C 'leverag':149C 'local':7A,36B,55B,87C,94C 'local-privilege-escal':35B 'low':57B,117C 'low-privileg':56B,116C 'method':52B,86C,145C 'must':109C 'obtain':111C 'order':125C 'privileg':37B,58B,88C,98C,118C,154C 'pwn2own':39B 'result':140C 'root':11A,74B,163C 'run':66B 'servic':14A,42B,137C 'specif':131C 'system':123C 'target':122C 'unit':6A,29B 'user':8A,59B 'via':12A 'vulner':90C,92C,129C,151C 'within':134C 'zdi':166C 'zdi-can':165C","nicknames":[],"mitigations":[],"who_affected":"Owners of Alpine iLX-F511 head units. The attacker must already run low-privileged code on the device (for example via another of the iLX-F511 bugs disclosed the same day), then can reach root through the Fiv service. Other hardware can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118602","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118602","severity":null,"published_at":"2026-10-28T17:18:27+00:00","modified_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118602:962","url":null,"severity":null,"published_at":"2026-10-28T17:35:12+00:00","modified_at":"2026-10-28T17:35:12+00:00","first_seen_at":"2026-10-28T17:35:12+00:00","fetched_at":"2026-10-28T17:35:12+00:00","note":"Read ZDI-26-820 (primary for this 0-day, Pwn2Own Automotive 2026, Sina Kheirkhah/Summoning Team). Vendor had not fixed it by disclosure (reported 2026-02-04, no patch); no affected firmware versions or fixed version published; ZDI says only mitigation is to restrict interaction with the device. No PoC or exploitation seen; social search skipped."}],"documents":[{"id":11630,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-820/","title":"ZDI-26-820 Alpine iLX-F511 Fiv.System LPE (0-day)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}