{"id":"CVE-2026-118606","kind":"vulnerability","aliases":["CVE-2026-118606"],"related":[],"title":"Alpine iLX-F511 head unit: exposed function lets network attackers run root code","description":"Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the framework service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29006.","summary":"The framework service on Alpine iLX-F511 devices exposes a dangerous function that an attacker on the local network can call. Successful exploitation runs arbitrary code with root privileges on the device.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"iLX-F511","fixed":[],"affected":"all firmware versions (unspecified by ZDI)","ecosystem":"vendor"}],"ecosystems":[],"tags":["alpine","automotive-head-unit","embedded","ilx-f511","infrastructure","network-adjacent","no-patch","pwn2own","unauthenticated"],"not_affected_if":["no-alpine-ilx-f511"],"how_to_check":"Any Alpine iLX-F511 is presumed affected; firmware versions unknown. Check the model and firmware in the head unit's settings; no fix version exists to compare against.","fix":"No vendor fix as of 2026-10-28 (ZDI published as 0-day). Check Alpine support for firmware newer than V 5.0.001 later.","status":"open","published_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","triaged_at":"2026-10-28T17:34:17+00:00","updated_at":"2026-10-28T17:35:08+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-28T17:34:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Alpine iLX-F511 head unit: exposed function lets network attackers run root code","impact":"high","summary":"The framework service on Alpine iLX-F511 devices exposes a dangerous function that an attacker on the local network can call. Successful exploitation runs arbitrary code with root privileges on the device.","category":"infrastructure","nicknames":[],"who_cares":["alpine","ilx-f511","embedded","automotive-head-unit"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs arbitrary code as root on the device","analyst_note":"Find the affected firmware versions and any vendor fix or mitigation from the NVD entry and the ZDI advisory for ZDI-CAN-29006.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-alpine-ilx-f511"],"who_is_affected":"Owners of Alpine iLX-F511 devices on a network where an attacker could reach the device. The sources do not name affected firmware versions or say whether any setting turns the exposure off. Teams without these devices can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000555,"input_tokens":3394,"output_tokens":432,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected firmware versions and any vendor fix or mitigation from the NVD entry and the ZDI advisory for ZDI-CAN-29006.","search":"'-118606':17A,20A '-2026':16A,19A '29006':150C 'adjac':36B,93C 'affect':100C 'allow':90C 'alpin':1A,24B,46B,75C,103C 'arbitrari':67B,97C 'attack':11A,57B,94C,133C 'authent':108C 'automot':26B 'automotive-head-unit':25B 'call':63B 'code':14A,68B,85C,98C,140C 'context':143C 'cve':15A,18A 'danger':53B,82C,130C 'devic':50B,74B,107C 'embed':29B 'execut':86C,96C,139C 'exist':119C 'exploit':65B,113C 'expos':7A,51B,81C,129C 'f511':4A,23A,32B,49B,78C,106C 'flaw':118C 'framework':43B,79C,122C 'function':8A,54B,83C,131C 'head':5A,27B 'ilx':3A,22A,31B,48B,77C,105C 'ilx-f511':2A,21A,30B,47B,76C,104C 'infrastructur':33B 'instal':101C 'issu':125C 'let':9A 'leverag':135C 'local':60B 'network':10A,35B,61B,92C 'network-adjac':34B,91C 'no-patch':37B 'patch':39B 'privileg':71B 'pwn2own':40B 'remot':84C 'requir':111C 'result':126C 'root':13A,70B,145C 'run':12A,66B 'servic':44B,80C,123C 'specif':117C 'success':64B 'unauthent':41B 'unit':6A,28B 'vulner':87C,89C,115C,137C 'within':120C 'zdi':148C 'zdi-can':147C","nicknames":[],"mitigations":[],"who_affected":"Owners of Alpine iLX-F511 devices on a network where an attacker could reach the device. The sources do not name affected firmware versions or say whether any setting turns the exposure off. Teams without these devices can skip it.","tier":"B","verified":{"who_affected":{"at":"2026-10-28T17:35:08Z","by":"analyst","run_id":961}},"analyst_revisit_at":null,"first_public_at":"2026-10-28T17:18:27+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118606","severity":null,"published_at":"2026-10-28T17:18:27+00:00","modified_at":"2026-10-28T17:18:27+00:00","first_seen_at":"2026-10-28T17:34:09+00:00","fetched_at":"2026-10-28T17:34:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118606:961","url":null,"severity":null,"published_at":"2026-10-28T17:35:08+00:00","modified_at":"2026-10-28T17:35:08+00:00","first_seen_at":"2026-10-28T17:35:08+00:00","fetched_at":"2026-10-28T17:35:08+00:00","note":"Read ZDI-26-824 (primary for 0-day): unpatched, vendor acknowledged 06/07/26 but no fix; ZDI says only mitigation is restricting interaction with the device. No affected firmware versions published; Pwn2Own Automotive 2026 finding (Compass Security). No public PoC or exploitation seen."}],"documents":[{"id":11628,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-824/","title":"ZDI-26-824 Alpine iLX-F511 Framework Service Exposed Dangerous Function RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":11629,"url":"https://www.thezdi.com/blog/2026/1/22/pwn2own-automotive-2026-day-two-results","title":"Pwn2Own Automotive 2026 Day Two Results","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}