Ilx F511
Monthly
A stack-based buffer overflow in the Android Auto service on Alpine iLX-F511 head units lets network-adjacent attackers run arbitrary code as root without authentication or user interaction. The flaw is an unchecked length on user-supplied data copied into a fixed-length stack buffer (CWE-121), rated CVSS 8.8 High (AV:A/AC:L/PR:N/UI:N, C/H/I/H/A:H); successful exploitation grants full control of the device in the root context. Confirmed affected firmware is iLX-F511 7.0.000 per ENISA EUVD-2026-112205; no public exploit code and no CISA KEV listing were identified at time of analysis, and the practical constraint is that an attacker must be within the Android Auto connection range (wireless or USB proximity) rather than able to reach the unit over the open internet.
Remote code execution in the framework service of the Alpine iLX-F511 infotainment head unit allows network-adjacent attackers to run arbitrary code as root on affected installations, specifically the 7.0.000 firmware listed by EUVD. Per the assessed CVSS vector (AV:A/AC:L/PR:N/UI:N), no authentication and no user interaction are required - the only real obstacle is proximity, since the attacker must reach the device over the same local network segment, Wi-Fi, or adjacent link rather than from the internet. At the time of analysis there is no CISA KEV listing and no public exploit identified; the ZDI advisory (ZDI-26-824) is the primary reference, and the vulnerability is rated this_week rather than emergency priority: credible and high-severity, but gated by the adjacency requirement.
A stack-based buffer overflow in the prh_sdp_service_search_decode function of the Alpine iLX-F511 in-vehicle head unit (version 7.0.000 per EUVD) allows network-adjacent attackers to execute arbitrary code as root. Exploitation requires Bluetooth radio proximity and that the attacker first pair a malicious Bluetooth device with the target, which depends on user interaction to accept the pairing; after pairing, crafted SDP service-search data is copied into a fixed-size stack buffer without length validation. No public exploit or confirmed active exploitation was identified at time of analysis, and the priority signals (this_week) reflect a genuine high-severity flaw with meaningful prerequisites rather than an emergency.
A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) lets an attacker within Bluetooth range execute arbitrary code as root on the head unit. The attacker must operate a malicious Bluetooth device and convince the user to connect the iLX-F511 to it, after which a crafted vCard containing contact data is parsed without adequate length validation and overruns a fixed-length stack buffer; no authentication is required on the attacker's side. Reach is proximity-bound and dependent on that deliberate user-initiated pairing, and no public exploit code was identified at time of analysis, so this is a patch-priority issue rather than a mass-exploitation emergency. The flaw was reported through the Zero Day Initiative as ZDI-CAN-29017 / ZDI-26-821.
Local privilege escalation in the Alpine iLX-F511 in-vehicle media receiver lets code already running as a low-privileged user reach root through an exposed dangerous method in the Fiv service, with high impact to confidentiality, integrity and availability. The attack is local-only and requires a prior foothold on the device (CVSS PR:L), so it is a post-compromise escalation step rather than a remotely reachable entry point; no user interaction is needed once that prerequisite is met. EUVD lists version 7.0.000 as affected, a public ZDI advisory (ZDI-26-820, ZDI-CAN-29095) documents the finding, and no vendor-released patch was identified at time of analysis, with no public exploit identified at time of analysis and no CISA KEV listing.
A heap-based buffer overflow in the Bluetooth OBEX packet handling of the Alpine iLX-F511 in-car head unit (version 7.0.000 per EUVD) lets an attacker within Bluetooth range send an over-long OBEX payload that is copied into a heap buffer without adequate length validation, resulting in arbitrary code execution with root privileges. No authentication or user interaction is required, but the CVSS vector is AV:P and the vendor description explicitly limits the threat to physically present attackers, so the practical constraint is Bluetooth-OBEX proximity to a discoverable/pairable unit rather than internet reachability - which is why the base score sits at 6.8 despite high confidentiality, integrity and availability impact. No CISA KEV entry and no public exploit code were identified at time of analysis; the finding was reported through the Zero Day Initiative (ZDI-CAN-29012 / ZDI-26-829) and vuln.today prioritizes it as this_month.
Unauthenticated code execution as root on Alpine iLX-F511 in-car head units (version 7.0.000) is possible because the Android Auto connection handler copies attacker-supplied data into a fixed-length stack buffer without validating its length (CWE-121). Exploitation requires physical presence at the unit (CVSS AV:P); an attacker who can establish a wired Android Auto session with the head unit and deliver over-length data can corrupt the stack and redirect execution with root privileges, with no authentication (PR:N) and no action by the vehicle owner (UI:N). CVSS 3.1 base score is 6.8; CISA KEV does not list this issue, no public exploit code has been identified at time of analysis, and no EPSS estimate was supplied with the available intelligence.
An out-of-bounds read in the Bluetooth RFCOMM control-channel handler prh_rfcomm_cc_process_test (inside libanwbtstack.so) on Alpine iLX-F511 in-dash units running firmware 7.0.000 lets a network-adjacent attacker leak limited process memory. The attacker must first pair a malicious Bluetooth device with the head unit - a user-interaction prerequisite (UI:R) - after which a crafted message reaches the vulnerable handler without further authentication (PR:N). Impact of the primitive alone is confined to low-confidentiality disclosure (C:L) for an assessed CVSS of 3.5; the ZDI advisory and CVE description note that chaining with other flaws would be needed to reach arbitrary code execution as root. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the vuln.today decision label is 'monitor'.
Command injection in the 'diagapp' diagnostic component of the Alpine iLX-F511 in-dash infotainment head unit lets a physically present attacker run arbitrary commands as root, because a user-supplied string is passed to a system call without validation. Exploitation requires hands-on physical access to the head unit and interaction with diagapp; no authentication or user interaction is needed once that access is obtained, and the flaw cannot be reached remotely or over a network. A public PoC reference exists in the form of the ZDI advisory (ZDI-26-825 / ZDI-CAN-28750), though it is not verified as working exploit code; no confirmed active exploitation (CISA KEV) is reported, and the vendor-reported CVSS of 6.8 reflects the physical attack vector that keeps realistic exposure limited to shared, rented, serviced or resold vehicles and workshop settings.
Stack-based buffer overflow in the framework service of the Alpine iLX-F511 in-vehicle head unit allows an attacker with hands-on access to the device to execute arbitrary code as root. Only firmware version 7.0.000 is identified as affected, and no authentication or user interaction is required once the attacker can reach the service, which keeps the CVSS complexity low. The physical attack vector (AV:P) is the decisive constraint: the flaw is not network-reachable, EPSS and CISA KEV data provided do not indicate active exploitation, and no public exploit code has been identified at time of analysis. Reported by ZDI as ZDI-CAN-29007 / ZDI-26-822 and tracked in ENISA EUVD as EUVD-2026-112197.
Hard-coded SSH credentials in Alpine iLX-F511 firmware 7.0.000 allow network-adjacent, unauthenticated attackers to log in and execute code as the telechips user; the CVSS 3.0 score is 6.3 with low confidentiality, integrity, and availability impact. Exploitation requires reachability to the device's SSH service from the same or an adjacent network segment, not the open internet, and no public exploit has been identified at time of analysis. The supplied intelligence does not confirm active exploitation.
A stack-based buffer overflow in the Android Auto service on Alpine iLX-F511 head units lets network-adjacent attackers run arbitrary code as root without authentication or user interaction. The flaw is an unchecked length on user-supplied data copied into a fixed-length stack buffer (CWE-121), rated CVSS 8.8 High (AV:A/AC:L/PR:N/UI:N, C/H/I/H/A:H); successful exploitation grants full control of the device in the root context. Confirmed affected firmware is iLX-F511 7.0.000 per ENISA EUVD-2026-112205; no public exploit code and no CISA KEV listing were identified at time of analysis, and the practical constraint is that an attacker must be within the Android Auto connection range (wireless or USB proximity) rather than able to reach the unit over the open internet.
Remote code execution in the framework service of the Alpine iLX-F511 infotainment head unit allows network-adjacent attackers to run arbitrary code as root on affected installations, specifically the 7.0.000 firmware listed by EUVD. Per the assessed CVSS vector (AV:A/AC:L/PR:N/UI:N), no authentication and no user interaction are required - the only real obstacle is proximity, since the attacker must reach the device over the same local network segment, Wi-Fi, or adjacent link rather than from the internet. At the time of analysis there is no CISA KEV listing and no public exploit identified; the ZDI advisory (ZDI-26-824) is the primary reference, and the vulnerability is rated this_week rather than emergency priority: credible and high-severity, but gated by the adjacency requirement.
A stack-based buffer overflow in the prh_sdp_service_search_decode function of the Alpine iLX-F511 in-vehicle head unit (version 7.0.000 per EUVD) allows network-adjacent attackers to execute arbitrary code as root. Exploitation requires Bluetooth radio proximity and that the attacker first pair a malicious Bluetooth device with the target, which depends on user interaction to accept the pairing; after pairing, crafted SDP service-search data is copied into a fixed-size stack buffer without length validation. No public exploit or confirmed active exploitation was identified at time of analysis, and the priority signals (this_week) reflect a genuine high-severity flaw with meaningful prerequisites rather than an emergency.
A stack-based buffer overflow in the vCard parser of the Alpine iLX-F511 in-dash multimedia receiver (build 7.0.0000) lets an attacker within Bluetooth range execute arbitrary code as root on the head unit. The attacker must operate a malicious Bluetooth device and convince the user to connect the iLX-F511 to it, after which a crafted vCard containing contact data is parsed without adequate length validation and overruns a fixed-length stack buffer; no authentication is required on the attacker's side. Reach is proximity-bound and dependent on that deliberate user-initiated pairing, and no public exploit code was identified at time of analysis, so this is a patch-priority issue rather than a mass-exploitation emergency. The flaw was reported through the Zero Day Initiative as ZDI-CAN-29017 / ZDI-26-821.
Local privilege escalation in the Alpine iLX-F511 in-vehicle media receiver lets code already running as a low-privileged user reach root through an exposed dangerous method in the Fiv service, with high impact to confidentiality, integrity and availability. The attack is local-only and requires a prior foothold on the device (CVSS PR:L), so it is a post-compromise escalation step rather than a remotely reachable entry point; no user interaction is needed once that prerequisite is met. EUVD lists version 7.0.000 as affected, a public ZDI advisory (ZDI-26-820, ZDI-CAN-29095) documents the finding, and no vendor-released patch was identified at time of analysis, with no public exploit identified at time of analysis and no CISA KEV listing.
A heap-based buffer overflow in the Bluetooth OBEX packet handling of the Alpine iLX-F511 in-car head unit (version 7.0.000 per EUVD) lets an attacker within Bluetooth range send an over-long OBEX payload that is copied into a heap buffer without adequate length validation, resulting in arbitrary code execution with root privileges. No authentication or user interaction is required, but the CVSS vector is AV:P and the vendor description explicitly limits the threat to physically present attackers, so the practical constraint is Bluetooth-OBEX proximity to a discoverable/pairable unit rather than internet reachability - which is why the base score sits at 6.8 despite high confidentiality, integrity and availability impact. No CISA KEV entry and no public exploit code were identified at time of analysis; the finding was reported through the Zero Day Initiative (ZDI-CAN-29012 / ZDI-26-829) and vuln.today prioritizes it as this_month.
Unauthenticated code execution as root on Alpine iLX-F511 in-car head units (version 7.0.000) is possible because the Android Auto connection handler copies attacker-supplied data into a fixed-length stack buffer without validating its length (CWE-121). Exploitation requires physical presence at the unit (CVSS AV:P); an attacker who can establish a wired Android Auto session with the head unit and deliver over-length data can corrupt the stack and redirect execution with root privileges, with no authentication (PR:N) and no action by the vehicle owner (UI:N). CVSS 3.1 base score is 6.8; CISA KEV does not list this issue, no public exploit code has been identified at time of analysis, and no EPSS estimate was supplied with the available intelligence.
An out-of-bounds read in the Bluetooth RFCOMM control-channel handler prh_rfcomm_cc_process_test (inside libanwbtstack.so) on Alpine iLX-F511 in-dash units running firmware 7.0.000 lets a network-adjacent attacker leak limited process memory. The attacker must first pair a malicious Bluetooth device with the head unit - a user-interaction prerequisite (UI:R) - after which a crafted message reaches the vulnerable handler without further authentication (PR:N). Impact of the primitive alone is confined to low-confidentiality disclosure (C:L) for an assessed CVSS of 3.5; the ZDI advisory and CVE description note that chaining with other flaws would be needed to reach arbitrary code execution as root. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and the vuln.today decision label is 'monitor'.
Command injection in the 'diagapp' diagnostic component of the Alpine iLX-F511 in-dash infotainment head unit lets a physically present attacker run arbitrary commands as root, because a user-supplied string is passed to a system call without validation. Exploitation requires hands-on physical access to the head unit and interaction with diagapp; no authentication or user interaction is needed once that access is obtained, and the flaw cannot be reached remotely or over a network. A public PoC reference exists in the form of the ZDI advisory (ZDI-26-825 / ZDI-CAN-28750), though it is not verified as working exploit code; no confirmed active exploitation (CISA KEV) is reported, and the vendor-reported CVSS of 6.8 reflects the physical attack vector that keeps realistic exposure limited to shared, rented, serviced or resold vehicles and workshop settings.
Stack-based buffer overflow in the framework service of the Alpine iLX-F511 in-vehicle head unit allows an attacker with hands-on access to the device to execute arbitrary code as root. Only firmware version 7.0.000 is identified as affected, and no authentication or user interaction is required once the attacker can reach the service, which keeps the CVSS complexity low. The physical attack vector (AV:P) is the decisive constraint: the flaw is not network-reachable, EPSS and CISA KEV data provided do not indicate active exploitation, and no public exploit code has been identified at time of analysis. Reported by ZDI as ZDI-CAN-29007 / ZDI-26-822 and tracked in ENISA EUVD as EUVD-2026-112197.
Hard-coded SSH credentials in Alpine iLX-F511 firmware 7.0.000 allow network-adjacent, unauthenticated attackers to log in and execute code as the telechips user; the CVSS 3.0 score is 6.3 with low confidentiality, integrity, and availability impact. Exploitation requires reachability to the device's SSH service from the same or an adjacent network segment, not the open internet, and no public exploit has been identified at time of analysis. The supplied intelligence does not confirm active exploitation.