Login Request a demo
High severity · published Aug 1, 2025
CVE-2025-8476
Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability
8.0
CVSS
0.1%
EPSS
No
On KEV
Description
Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TIDAL music streaming application. The issue results from improper certificate validation. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26322.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IL
iLX-507 · Alpine
6.0.000 · source: vendor
IF
Ilx-507 Firmware · Alpsalpine
6.0.000 · source: NVD
Affected product
IL
iLX-507
Alpine
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8476
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8476
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-25-765/
More from iLX-507
8.0
CVE-2025-8480
Alpine iLX-507 Command Injection Remote Code Execution
7.4
CVE-2025-8477
Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
7.4
CVE-2025-8475
Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability
7.4
CVE-2025-8472
Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
6.8
CVE-2025-8474
Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability