Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the UPDM_wstpCBCUpdStart function. The issue results from the lack of proper validation of user-supplied data before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26317.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-762/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
12 Aug 2025, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:alpine-usa:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
cpe:2.3:h:alpsalpine:ilx-507:-:*:*:*:*:*:*:* cpe:2.3:o:alpsalpine:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
| First Time |
Alpsalpine ilx-507 Firmware
Alpsalpine Alpsalpine ilx-507 |
12 Aug 2025, 17:56
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.6 |
| CPE | cpe:2.3:h:alpine-usa:ilx-507:-:*:*:*:*:*:*:* cpe:2.3:o:alpine-usa:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
|
| First Time |
Alpine-usa ilx-507 Firmware
Alpine-usa ilx-507 Alpine-usa |
|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-25-762/ - Third Party Advisory |
01 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-01 18:15
Updated : 2025-08-12 18:10
NVD link : CVE-2025-8473
Mitre link : CVE-2025-8473
JSON object : View
Products Affected
alpsalpine
- ilx-507_firmware
- ilx-507
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')