CVE-2025-8476

8.0 highEPSS 0.1%

High (8.0) in alpsalpine ilx-507 firmware. EPSS 0.1% chance of exploitation in the next 30 days.

Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TIDAL music streaming application. The issue results from improper certificate validation. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26322.

Severity

CVSS 3.1

8.0 high

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-31)
CWE: CWE-295
Published: 2025-08-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

alpsalpine:ilx-507_firmware

References

https://www.zerodayinitiative.com/advisories/ZDI-25-765/

Check your stack JSON