Alpine iLX-507 Command Injection Vulnerability Allowing Arbitrary Code Execution

A command injection vulnerability has been identified in the Alpine iLX-507 device, specifically within the UPDM_wstpCBCUpdStart function. This vulnerability allows physically present attackers to execute arbitrary code with root privileges on the affected device. The issue arises from inadequate validation of user-supplied data before it is used to execute system calls. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the context of the root user.

Remediation

The recommended mitigation strategy is to limit interaction with the affected product.