Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Alpine Halo9 devices open to code execution by physical attackers

CVE-2024-23924 · published 2 years ago
Summary

Some Alpine Halo9 devices can be accessed by anyone, allowing attackers to run malicious code on the device. This is a serious security risk because it allows unauthorized access to the device. To mitigate this, it's recommended to restrict physical access to the device or apply any available software updates to fix the vulnerability.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
alpsalpine ilx-f509_firmware 6.0.000
cpe:2.3:o:alpsalpine:ilx-f509_firmware:6.0.000:*:*:*:*:*:*:*
Original advisory text
Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installat...
Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UPDM_wemCmdCreatSHA256Hash function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Was ZDI-CAN-23105
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published28 Sep 2024
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-23924 · NVD
Track software like this
Free during beta