---
id: "CVE-2026-118606"
kind: "vulnerability"
aliases: ["CVE-2026-118606"]
title: "Alpine iLX-F511 head unit: exposed function lets network attackers run root code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "iLX-F511", "fixed": [], "affected": "all firmware versions (unspecified by ZDI)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["alpine", "automotive-head-unit", "embedded", "ilx-f511", "infrastructure", "network-adjacent", "no-patch", "pwn2own", "unauthenticated"]
not_affected_if: ["no-alpine-ilx-f511"]
published_at: "2026-10-28T17:18:27+00:00"
first_seen_at: "2026-10-28T17:34:09+00:00"
updated_at: "2026-10-28T17:35:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118606", "first_seen_at": "2026-10-28T17:34:09+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T17:35:08+00:00"}]
---

# Alpine iLX-F511 head unit: exposed function lets network attackers run root code

The framework service on Alpine iLX-F511 devices exposes a dangerous function that an attacker on the local network can call. Successful exploitation runs arbitrary code with root privileges on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:iLX-F511 affected all firmware versions (unspecified by ZDI) fixed ?

## How to check

Any Alpine iLX-F511 is presumed affected; firmware versions unknown. Check the model and firmware in the head unit's settings; no fix version exists to compare against.

## Fix

No vendor fix as of 2026-10-28 (ZDI published as 0-day). Check Alpine support for firmware newer than V 5.0.001 later.

## Timeline

- 2026-10-28T17:34:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118606
- 2026-10-28T17:35:08+00:00 analyst — Read ZDI-26-824 (primary for 0-day): unpatched, vendor acknowledged 06/07/26 but no fix; ZDI says only mitigation is restricting interaction with the device. No affected firmware versions published; Pwn2Own Automotive 2026 finding (Compass Security). No public PoC or exploitation seen.

## Documents

- [advisory] ZDI-26-824 Alpine iLX-F511 Framework Service Exposed Dangerous Function RCE https://www.zerodayinitiative.com/advisories/ZDI-26-824/
- [mentions] Pwn2Own Automotive 2026 Day Two Results https://www.thezdi.com/blog/2026/1/22/pwn2own-automotive-2026-day-two-results

## From the sources

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the framework service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29006.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_