ZDI 2026-10-28

ZDI-26-826: (0Day) (Pwn2Own) Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read Information Disclosure Vulnerability

Machine-generated analysis · WAYSCloud LLM

The advisory reports an out-of-bounds read in libanwbtstack.so's prh_rfcomm_cc_process_test function, resulting in information disclosure. Exploitation requires pairing a malicious Bluetooth device.

Context

The affected product is the Alpine iLX-F511 device, specifically the libanwbtstack.so library. The vulnerability is an out-of-bounds read in the prh_rfcomm_cc_process_test function that can disclose sensitive information. Exploitation requires the attacker to first pair a malicious Bluetooth device, implying a network-adjacent but Bluetooth-proximate threat.

Operator considerations

Check: verify the version of libanwbtstack.so and current Bluetooth pairing configuration on the iLX-F511.
Isolate: if feasible, disable or restrict Bluetooth pairing to trusted devices.
Log: enable logging of Bluetooth pairing attempts and failures.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Alpine iLX-F511 devices. An attacker must first obtain the ability to pair a malicious Bluetooth device with the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 3.5.

Read the full advisory on ZDI →