CVE-2026-118607: Alpine iLX-F511 diagapp Command Injection Vulnerability
Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the diagapp component. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28750.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be physically present at an affected Alpine iLX-F511 device. No authentication is required.
What access does successful exploitation provide?
Successful exploitation allows arbitrary code execution in the context of root, resulting in high confidentiality, integrity, and availability impact.
Which component is affected?
The vulnerable component is diagapp. It does not properly validate a user-supplied string before using it in a system call.