ZDI-CAN-28750: (0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability

Published Oct 28, 2026

Updated

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the diagapp component. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Other sources

— ZDI

Affected Software

1 affected component

Alpine iLX-F511

Event History

Oct 28, 2026

Advisory Published

via ZDI·12:00 AM

Data Sourced

via ZDI·12:00 AM

DescriptionSeverityAffected Software

Advisory Published

via ZDI·05:00 AM

Frequently Asked Questions

Who can realistically exploit this issue?

An attacker must be physically present at an affected Alpine iLX-F511 device. No authentication is required.

What level of access could exploitation provide?

Successful exploitation can execute arbitrary code in the context of root, potentially giving the attacker full control of the affected device.

What component should be investigated during triage?

The flaw is in the diagapp component, where a user-supplied string is insufficiently validated before being used in a system call.

ZDI-CAN-28750: (0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability

Other sources

Affected Software

Event History

Frequently Asked Questions

Who can realistically exploit this issue?

What level of access could exploitation provide?

What component should be investigated during triage?

Company

Resources

Contact

Frequently Asked Questions

Who can realistically exploit this issue?

What level of access could exploitation provide?

What component should be investigated during triage?