CVE-2026-118606

The record

Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the framework service. The issue results from an exposed dangerous function. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29006.

Affected packages

Related vulnerabilities

• CVE-2026-119978 Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated… CWE-749
• CVE-2026-66088 In openEQUELLA before 2026.1, the system.execute() function available to the scripting… CWE-749
• CVE-2026-118602 Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation… CWE-749
• CVE-2026-113775 A maliciously crafted dynamic library, when loaded from an arbitrary path through the… CWE-749
• CVE-2026-116019 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page… CWE-749
• CVE-2026-70387 Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus… CWE-749
• CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation… CWE-749
• CVE-2026-86711 electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron… CWE-749