PT-2025-31668 · Alpine+1 · Alpine Ilx-507+1

Hama7230 · Published 2025-01-27 · Updated 2025-08-12 · CVE-2025-8476

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alpine iLX-507 (affected versions not specified)

Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required for exploitation. The flaw resides within the TIDAL music streaming application due to improper certificate validation. An attacker can leverage this, in conjunction with other vulnerabilities, to execute arbitrary code with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-09484

CVE-2025-8476

ZDI-25-765

Affected Products

Alpine Ilx-507

Tidal

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-8476 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-765 · Security Note
• https://bdu.fstec.ru/vul/2025-09484 · Security Note
• https://osv.dev/vulnerability/CVE-2025-8476 · Vendor Advisory
• https://t.me/CVEtracker/28965 · Telegram Post
• https://t.me/cveNotify/131892 · Telegram Post
• https://twitter.com/CVEnew/status/1951341858166128845 · Twitter Post