Alpine iLX-F511 CVE-2026-118601

Requires network-adjacent reachability to the SSH service of an Alpine iLX-F511 (firmware 7.0.000) device - per CVSS AV:A the attacker must be on the same or an adjacent network segment (local link, vehicle network, or proximate wireless bridge), not the open internet. No legitimate authentication is needed because the SSH service ships with hard-coded credentials (PR:N). Principal limiting factors: the adjacency requirement (not remotely internet-exploitable), and that resulting code execution is confined to the unprivileged 'telechips' account rather than root, bounding confidentiality/integrity/availability impact.

This is a medium-severity issue (CVSS 6.3) whose signals are internally consistent rather than conflicting. The CVSS:3.0 vector AV:A/AC:L/PR:N/UI:N tells the real story: exploitation needs no authentication (hard-coded credentials remove that barrier, so PR:N is accurate) and is low-complexity, but the attack vector is Adjacent (AV:A) - not Network - meaning the attacker must already be on the same local/adjacent network segment as the head unit (e.g. the vehicle's own bus/Wi-Fi/Bluetooth-bridged network or a physically proximate link), not the open internet. Impact is only partial across the board (C:L/I:L/A:L) because code runs as the unprivileged 'telechips' user, not root, which caps the blast radius. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference was supplied (only the ZDI advisory itself) - so there is no evidence of active exploitation. The vuln.today priority is 'this_month', consistent with a serious but not emergency finding. Net: this is a genuine, easily-exploited-by-a-proximate-attacker flaw, but the adjacency requirement and non-root impact keep it below critical real-world urgency. Missing data to note: no EPSS and no KEV status to weigh widespread-exploitation likelihood.

An attacker with access to the same network as an Alpine iLX-F511 in-vehicle head unit (for example via a connected/companion network interface or local proximity) reaches the device's exposed SSH service. Using the undocumented hard-coded credentials, they log in without any legitimate authentication and run arbitrary commands as the 'telechips' user. No public exploit code was identified in the provided data, but the technique is trivial once the credentials are known.