---
id: "CVE-2026-118602"
kind: "vulnerability"
aliases: ["CVE-2026-118602"]
title: "Alpine iLX-F511 head unit: local user escalates to root via Fiv service"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "iLX-F511", "fixed": [], "affected": "all firmware versions; no range published (unknown)", "ecosystem": "hardware"}]
ecosystems: []
tags: ["0day", "alpine", "automotive-head-unit", "embedded", "ilx-f511", "infrastructure", "local-privilege-escalation", "pwn2own"]
not_affected_if: ["other-hardware"]
published_at: "2026-10-28T17:18:27+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:35:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118602", "first_seen_at": "2026-10-28T17:34:09+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:35:12+00:00"}]
---

# Alpine iLX-F511 head unit: local user escalates to root via Fiv service

The Fiv service on the Alpine iLX-F511 exposes a dangerous method that a local low-privileged user can call. An attacker who already runs code on the device can escalate to root and execute arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- hardware:iLX-F511 affected all firmware versions; no range published (unknown) fixed ?

## How to check

On the unit: HOME > Setup > System > About to read the firmware version (per Alpine's firmware readme). Every iLX-F511 is presumed affected; the advisory lists no version range.

## Fix

No vendor fix as of 2026-10-28 (ZDI published as 0-day). Check Alpine support for a firmware newer than your current one; no fixed version known.

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118602
- 2026-10-28T17:35:12+00:00 analyst — Read ZDI-26-820 (primary for this 0-day, Pwn2Own Automotive 2026, Sina Kheirkhah/Summoning Team). Vendor had not fixed it by disclosure (reported 2026-02-04, no patch); no affected firmware versions or fixed version published; ZDI says only mitigation is to restrict interaction with the device. No PoC or exploitation seen; social search skipped.

## Documents

- [advisory] ZDI-26-820 Alpine iLX-F511 Fiv.System LPE (0-day) https://www.zerodayinitiative.com/advisories/ZDI-26-820/

## From the sources

Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the Fiv service. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29095.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_