Alpine iLX-F511: Remote code execution via exposed dangerous function
Summary
The framework service of the Alpine iLX-F511 in-car head unit exposes a dangerous function. A network-adjacent attacker can use it to execute arbitrary code with root privileges, without authentication. The advisory does not describe the exact attack path or the required proximity, and no vendor fix has been published.
Affected
- Alpine iLX-F511
- Version 7.0.000 according to third-party aggregators (unverified, not confirmed by Alpine)
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor advisory or fixed firmware version was found at the time of research.
Workaround
- Restrict interaction with the product, as stated in the ZDI advisory (the only mitigation documented there).
- Turn off Bluetooth and wireless smartphone projection when not needed (own suggestion, not vendor guidance).
- Limit which devices may connect to the unit and do not connect untrusted phones or USB devices (own suggestion).
Exploitation
- Not known to be exploited in the wild.
- No CISA KEV entry.
- A public PoC is unverified: a Sploitus entry repeats the advisory text only.
- EPSS: 0.34 % (low).
Our recommendation
- Check whether any iLX-F511 units are installed in company vehicles or fleets.
- Confirm the firmware version on each unit directly and ask your installer or Alpine dealer about updates.
- Restrict wireless connections and paired devices, and avoid connecting untrusted devices.
- Monitor Alpine's support pages and the ZDI advisory for a fix and apply it as soon as it is available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ZDI advisory ZDI-26-824 www.zerodayinitiative.com
- PSIRT CVE-2026-118606 psirt.com
- Threat Intel CVE-2026-118606 cve.threatint.com
- OffSeq CVE-2026-118606 radar.offseq.com
- Sploitus entry (unverified PoC claim) sploitus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:27.
Original description (NVD)
Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29006.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.