ZDI-26-825: (0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp component. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
Other sources
This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8. The following CVEs are assigned: CVE-2026-118607.
— ZDI
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be physically present at an affected Alpine iLX-F511 device. No authentication is required.
What level of access could an attacker obtain?
Successful exploitation allows arbitrary code execution in the context of root, which can result in full compromise of the device.
Which component is involved?
The flaw is in the diagapp component, where a user-supplied string is not properly validated before it is used in a system call.