CVE-2025-8476 HIGH

CVE-2025-8476: Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability

Vendor Alpine
Product iLX-507
Weakness CWE-295
Published August 1, 2025
Last update August 1, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Adjacent
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TIDAL music streaming application. The issue results from improper certificate validation. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-26322.

Key dates

02Disclosure timeline

August 1, 2025 CVE published
August 1, 2025 Record updated