Alpine iLX-F511 CVE-2026-118607

Requires hands-on PHYSICAL access to the Alpine iLX-F511 (an in-dash automotive infotainment head unit) and interaction with the 'diagapp' diagnostic component, into which an attacker supplies a crafted, unvalidated string that is then passed to a system call (CWE-78). No authentication (PR:N) and no user interaction (UI:N) are needed once physical access is obtained. The dominant limiting factor is the physical attack vector (AV:P): the flaw cannot be triggered remotely or over a network, so realistic exposure is limited to scenarios where an attacker is physically at the device (shared/rented/serviced/resold vehicles, workshops). The specific interface or trigger path within diagapp beyond the diagnostic input is not described in the available sources.

This is a genuine high-impact-but-constrained issue rather than a widespread emergency. The CVSS 3.0 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) tells a clear story: impact is maximal (code execution as root, so C:H/I:H/A:H) but the attack vector is PHYSICAL (AV:P), which is the single most important limiting signal and the reason the score lands at Medium despite root-level RCE. No authentication is required (PR:N) and no user interaction (UI:N), but an attacker must be physically present at the device. No EPSS score is provided and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation; the vuln.today decision label is 'this_month' (a moderate-priority queue, not act_now/emergency), which is consistent with a high-severity-but-physical-access flaw. There is no confirmed public exploit - only the ZDI advisory reference. The signals are therefore internally consistent (physical access + no exploitation evidence + this_month priority all align); the main caveat is that for an in-vehicle head unit, 'physical access' is a lower bar than for a datacenter asset, since many people (passengers, valets, repair shops, resale buyers) gain brief physical proximity.

An attacker with brief physical access to an Alpine iLX-F511 head unit (e.g., in a serviced, shared, rented, or resold vehicle) interacts with the diagnostic 'diagapp' component and supplies a crafted string that is passed unsanitized into a system call. Because the input is not validated, the injected command executes as root, giving full control of the infotainment unit. No authentication or user interaction is needed, but hands-on access to the device is required; no public working exploit has been identified.