Hard‑coded SSH Credentials Enable Unauthenticated RCE in Alpine iLX‑F511 (CVE‑2026‑118601)
What It Is — A Zero‑Day vulnerability (CVE‑2026‑118601) in the SSH service of Alpine’s iLX‑F511 video‑conferencing appliance allows an unauthenticated, network‑adjacent attacker to execute arbitrary code as the privileged telechips user. The flaw stems from hard‑coded SSH credentials that cannot be changed, giving attackers remote code execution (RCE) capability without any authentication step. The advisory, published by the Zero Day Initiative on 28 Oct 2026, assigns a CVSS 6.3 (Moderate) score (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). No vendor patch is available yet; mitigation is limited to network isolation.
Affected Products — Alpine iLX‑F511 hardware appliance (all firmware versions disclosed).
Why It Matters for Trust & Control Assurance — This issue directly tests the access‑control control objective: organizations must ensure that privileged accounts are not protected by hard‑coded secrets and that credential management is auditable. Verisq’s Access Controls capability can help you capture continuous evidence of credential hygiene and privileged‑access monitoring.
Recommended Actions
- Isolate iLX‑F511 devices from any untrusted networks until a vendor fix is released.
- Disable SSH access where possible or restrict it to trusted management subnets.
- Document the presence of hard‑coded credentials and map this gap to your access‑control policies.
- Initiate a vendor‑risk review to confirm remediation timelines and obtain written assurance.
- Begin logging all SSH connection attempts and retain logs for audit purposes.
Source: Zero Day Initiative Advisory