Cyber Posture

CVE-2026-0787

Critical

Published: 23 January 2026

Published
23 January 2026
Modified
18 February 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0059 69.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

ALGO 8180 IP Audio Alerter SAC Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The…

more

specific flaw exists within the SAC module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28296.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires validation of user-supplied strings prior to processing in system calls, addressing the core flaw in the SAC module that enables command injection.

preventrecover

Mandates timely identification, reporting, and correction of flaws like this command injection vulnerability, preventing exploitation through remediation such as patching.

prevent

Limits permitted actions without identification or authentication, mitigating unauthenticated remote exploitation of the SAC module vulnerability.

Security SummaryAI

CVE-2026-0787 is a SAC command injection vulnerability that enables remote code execution on ALGO 8180 IP Audio Alerter devices. The flaw resides in the SAC module, where a user-supplied string is not properly validated before being used in a system call, allowing attackers to inject and execute arbitrary commands. Published on 2026-01-23, this issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-78 (OS Command Injection). It was originally tracked as ZDI-CAN-28296.

Remote attackers can exploit this vulnerability without authentication, privileges, or user interaction, simply by sending crafted requests over the network. Exploitation results in arbitrary code execution in the context of the device, granting high-impact access to confidentiality, integrity, and availability.

The Zero Day Initiative advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-009/ provides further details on this vulnerability.

Details

CWE(s)

Affected Products

algosolutions
8180 ip audio alerter firmware
5.5

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

Unauthenticated remote OS command injection enables exploitation of a public-facing application (T1190) and arbitrary Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References