Alpine iLX-507 Command Injection Remote Code Execution Vulnerability

A command injection vulnerability allowing remote code execution has been identified in the Alpine iLX-507 device, specifically within the Tidal music streaming application. This issue arises from inadequate validation of user-supplied strings before they are used in system calls, enabling network-adjacent attackers to execute arbitrary code on the device. Notably, no authentication is required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device, with the executed code running in the device's context.

Remediation

Due to the nature of this vulnerability, the primary recommendation is to limit interaction with the affected product.