Cyber Posture

CVE-2026-0780

High

Published: 23 January 2026

Published
23 January 2026
Modified
13 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 59.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The…

more

specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28289.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the lack of proper validation of user-supplied strings before passing them to system calls, preventing command injection.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and remediation of flaws like this command injection vulnerability through patching or updates.

AC-6 Least Privilege partial match
prevent

Enforces least privilege on authenticated users and processes handling web UI inputs, limiting the scope and impact of remote code execution.

Security SummaryAI

CVE-2026-0780 is a command injection vulnerability (CWE-78) in the web-based user interface of ALGO 8180 IP Audio Alerter devices, enabling remote code execution. The flaw arises from insufficient validation of user-supplied strings before they are passed to system calls, allowing attackers to execute arbitrary code on affected installations. Published on 2026-01-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Remote attackers with low-privilege authentication can exploit this vulnerability over the network with low complexity and no user interaction required. By injecting a malicious string via the Web UI, they achieve arbitrary code execution in the context of the device, potentially compromising confidentiality, integrity, and availability with high impact.

The Zero Day Initiative advisory ZDI-26-002, corresponding to ZDI-CAN-28289, provides further details on the vulnerability. Security practitioners should review this reference for recommended mitigations.

Details

CWE(s)
CWE-78

Affected Products

algosolutions
8180 ip audio alerter firmware
5.5

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Command injection vulnerability in web UI enables exploitation of public-facing application (T1190) to achieve RCE via Unix shell command injection (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References