Cyber Posture

CVE-2026-0784

High

Published: 23 January 2026

Published
23 January 2026
Modified
13 February 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0037 59.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The…

more

specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28293.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the core flaw by requiring validation of user-supplied inputs before they are used in system calls, preventing command injection.

SI-2 Flaw Remediation good match
prevent

Mandates timely identification, reporting, and correction of flaws like this command injection vulnerability through patching and updates.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to limit the impact of arbitrary code execution by ensuring the web UI process runs with minimal necessary permissions.

Security SummaryAI

CVE-2026-0784 is a command injection vulnerability within the web-based user interface of ALGO 8180 IP Audio Alerter devices, enabling remote code execution. The flaw arises from insufficient validation of user-supplied strings before they are used in system calls, allowing attackers to inject and execute arbitrary commands. This issue affects installations of the ALGO 8180 IP Audio Alerter and is classified under CWE-78 (OS Command Injection), with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Authenticated remote attackers with low privileges can exploit this vulnerability over the network with no user interaction required. Successful exploitation allows execution of arbitrary code in the context of the device, granting high-impact access to confidentiality, integrity, and availability.

The Zero Day Initiative published advisory ZDI-26-006 detailing the vulnerability, available at https://www.zerodayinitiative.com/advisories/ZDI-26-006/. It was canonically reported as ZDI-CAN-28293.

Details

CWE(s)
CWE-78

Affected Products

algosolutions
8180 ip audio alerter firmware
5.5

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Command injection in web-based UI of network device enables exploitation of public-facing application (T1190) and arbitrary OS command execution via Unix shell (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References