---
id: CVE-2026-118606
title: >-
  Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code
  Execution Vulnerability
summary: >-
  Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code
  Execution Vulnerability. This vulnerability allows network-adjacent attackers
  to execute arbitrary code on affected installations of Alpine iLX-F511
  devices. Authen…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-749
vendor: Alpine
product: iLX-F511
affected:
  - iLX-F511 7.0.000
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T17:16:07.254834Z'
published: '2026-10-28'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T17:16:40.438Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118606'
references:
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-26-824/'
    label: ZDI-26-824
tags:
  - cve.org
epss: 0.00338
epssPercentile: 0.27345
zeroDay: true
ingestedAt: '2026-10-28T17:14:44.435Z'
---

## Overview

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the framework service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29006.

## Affected

- `iLX-F511 7.0.000`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.