Alpine iLX-F511 CVE-2026-118606

Exploitation requires the attacker to be network-adjacent to the Alpine iLX-F511 device (AV:A) - reachable via the same local network segment, Wi-Fi, or adjacent link rather than directly from the internet - and to be able to communicate with the device's framework service. Per CVSS PR:N/UI:N, no authentication and no user interaction are required, and the affected version is iLX-F511 7.0.000. The exposed dangerous function (CWE-749) is the prerequisite surface; the specific input or call that triggers it is not described in the available sources. The primary limiting factor is the adjacency requirement, which prevents remote internet-based exploitation and confines attacks to local proximity or a compromised adjacent host.

This is a credible, high-severity issue but not a drop-everything emergency. The CVSS 3.0 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a serious combination: low attack complexity, no privileges, no user interaction, and full compromise (code execution as root) of the device. The single mitigating factor baked into the score is the Adjacent (AV:A) attack vector - the attacker must be on the same local/adjacent network (e.g. shared Wi-Fi, Bluetooth, or a directly reachable vehicle network segment) rather than attacking across the internet, which sharply narrows realistic exposure. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-actively-exploited finding. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were provided in the input, so there is no signal of active or widespread exploitation at this time - this is a vendor/ZDI-disclosed flaw, not an observed in-the-wild campaign. The signals are internally consistent: high technical impact and easy local trigger, offset by adjacency requirement and absence of exploitation evidence. EPSS is absent (not low), so probability of near-term mass exploitation cannot be quantified from the data.

An attacker who is network-adjacent to the Alpine iLX-F511 head unit - for example sharing the vehicle's Wi-Fi hotspot or on the same local network segment - sends traffic to the exposed dangerous function in the device's framework service without needing any credentials. Because the function is reachable with no authentication and low complexity, the attacker triggers arbitrary code execution running as root, taking full control of the infotainment unit. No public exploit code was identified in the provided data; the single reference is a ZDI advisory, not verified working exploit code.