---
id: CVE-2026-118607
title: Alpine iLX-F511 diagapp Command Injection Vulnerability
summary: >-
  Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability
  allows physically present attackers to execute arbitrary code on affected
  installations of Alpine iLX-F511 devices. Authentication is not required to
  exploit thi…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: Alpine
product: iLX-F511
affected:
  - iLX-F511 7.0.000
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:50:30.502Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118607'
references:
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-26-825/'
    label: ZDI-26-825
tags:
  - cve.org
zeroDay: true
ingestedAt: '2026-10-28T17:14:44.432Z'
epss: 0.00869
epssPercentile: 0.58905
---

## Overview

Alpine iLX-F511 diagapp Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the diagapp component. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-28750.

## Affected

- `iLX-F511 7.0.000`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.