The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26324.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Alpine | iLX-507 | unknown |
|
Configuration 1 [-]
| AND |
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-23386 | Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26324. |
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-767/ |
|
Tue, 12 Aug 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Alpsalpine
Alpsalpine ilx-507 Alpsalpine ilx-507 Firmware |
|
| CPEs | cpe:2.3:o:alpine-usa:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
cpe:2.3:h:alpsalpine:ilx-507:-:*:*:*:*:*:*:* cpe:2.3:o:alpsalpine:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
| Vendors & Products |
Alpine-usa
Alpine-usa ilx-507 Alpine-usa ilx-507 Firmware |
Alpsalpine
Alpsalpine ilx-507 Alpsalpine ilx-507 Firmware |
Tue, 05 Aug 2025 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Alpine-usa
Alpine-usa ilx-507 Alpine-usa ilx-507 Firmware |
|
| CPEs | cpe:2.3:h:alpine-usa:ilx-507:-:*:*:*:*:*:*:* cpe:2.3:o:alpine-usa:ilx-507_firmware:6.0.000:*:*:*:*:*:*:* |
|
| Vendors & Products |
Alpine-usa
Alpine-usa ilx-507 Alpine-usa ilx-507 Firmware |
Fri, 01 Aug 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 01 Aug 2025 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target must connect to a malicious Bluetooth device. The specific flaw exists within the parsing of vCard data. The issue results from the lack of proper validation of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26324. | |
| Title | Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability | |
| Weaknesses | CWE-121 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2025-08-01T18:12:28.740Z
Reserved: 2025-08-01T17:20:29.833Z
Link: CVE-2025-8477
Vulnrichment
Updated: 2025-08-01T18:10:53.701Z
NVD
Status : Analyzed
Published: 2025-08-01T18:15:58.167
Modified: 2025-08-12T18:08:48.270
Link: CVE-2025-8477
Redhat
No data.
OpenCVE Enrichment
No data.