Alpine iLX-F511: Local privilege escalation via exposed dangerous method in Fiv service
Summary
The Alpine iLX-F511 in-vehicle media receiver contains a flaw in its Fiv service where an exposed dangerous method can be abused. An attacker who already has low-privileged code execution on the device can escalate privileges to root and run arbitrary code. The attack requires local access and a prior foothold, so it is a post-compromise step rather than a remote entry point.
Affected
- Alpine iLX-F511, firmware/product version 7.0.000
- Other versions: Unknown.
Fixed in
Unknown. No vendor patch or advisory was identified at the time of analysis.
Workaround
- Restrict interaction with the product, as recommended by ZDI.
- Limit which apps, devices and connections can run code on the head unit (inference, not a vendor statement).
Exploitation
- Not known to be exploited in the wild; CISA KEV: No.
- No public exploit identified at the time of analysis.
- EPSS is very low (0.12 %).
Our recommendation
- Identify whether company vehicles or equipment use the iLX-F511 and check the firmware version (7.0.000 is affected).
- Monitor Alpine support channels and ZDI for a fix and ask the vendor for a patch timeline.
- Until a fix exists, restrict device pairing, app installation and trust of connected devices as far as the device allows.
- Also review related iLX-F511 advisories published the same day (ZDI-26-819, ZDI-26-829), which may provide initial access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI-26-820 advisory www.zerodayinitiative.com
- VulDB entry CVE-2026-118602 vuldb.com
- OffSeq Radar: ZDI-26-820 radar.offseq.com
- Strix CVE-2026-118602 www.strix.ai
- ThreatInt CVE-2026-118602 cve.threatint.com
- vuln.today privilege escalation vuln.today
- Vulners CVE-2026-118602 vulners.com
- ZDI-26-829 advisory www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:51.
Original description (NVD)
Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Fiv service. The issue results from an exposed dangerous method. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-29095.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.