ZDI 2026-10-28

ZDI-26-825: (0Day) (Pwn2Own) Alpine iLX-F511 diagapp Command Injection Vulnerability

Machine-generated analysis · WAYSCloud LLM

Unauthenticated command injection can be triggered locally on Alpine iLX-F511 devices.

Context

The advisory concerns Alpine iLX-F511 devices. It describes a command injection vulnerability in the diagapp component that requires no authentication and can be exploited by a physically present attacker. The advisory assigns a CVSS score of 6.8.

Operator considerations

Check: Verify the presence and version of the diagapp component on iLX-F511 devices.
Isolate: Restrict physical access to the devices where feasible.
Log: Enable logging of diagapp activity if the platform supports it.

From Zero Day Initiative ↗

This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.8.

Read the full advisory on ZDI →

Related advisories