Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the TIDAL music streaming application. The issue results from improper certificate validation. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26322.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-765/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
12 Aug 2025, 18:10
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Alpsalpine ilx-507 Firmware
Alpsalpine Alpsalpine ilx-507 |
|
| CPE | cpe:2.3:o:alpine-usa:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
cpe:2.3:h:alpsalpine:ilx-507:-:*:*:*:*:*:*:* cpe:2.3:o:alpsalpine:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
12 Aug 2025, 17:53
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
| First Time |
Alpine-usa ilx-507 Firmware
Alpine-usa ilx-507 Alpine-usa |
|
| CPE | cpe:2.3:h:alpine-usa:ilx-507:-:*:*:*:*:*:*:* cpe:2.3:o:alpine-usa:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-25-765/ - Third Party Advisory |
01 Aug 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-01 18:15
Updated : 2025-08-12 18:10
NVD link : CVE-2025-8476
Mitre link : CVE-2025-8476
JSON object : View
Products Affected
alpsalpine
- ilx-507_firmware
- ilx-507
CWE
CWE-295
Improper Certificate Validation