High severity · published Oct 28, 2026
CVE-2026-118606
Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability
New
8.8
CVSS
–
EPSS
No
On KEV
Description
Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the framework service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29006.
CVSS vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IL
iLX-F511 · Alpine
7.0.000 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-118606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-118606
www.zerodayinitiative.com
https://www.zerodayinitiative.com/advisories/ZDI-26-824/
More from iLX-F511
8.8
CVE-2026-118610
Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability
8.0
CVE-2026-118605
Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability
8.0
CVE-2026-118603
Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
7.8
CVE-2026-118602
Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability
6.8
CVE-2026-118611
Alpine iLX-F511 Bluetooth OBEX Packet Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability