CVE-2026-0795
Published: 23 January 2026
Description
ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The…
more
specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28321.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the lack of proper validation of user-supplied strings before executing system calls in the web UI, preventing command injection.
Requires timely remediation of the specific command injection flaw through patching, eliminating the vulnerability.
Enforces least privilege on web UI processes, limiting the scope and impact of arbitrary code execution even if injection succeeds.
Security SummaryAI
CVE-2026-0795 is a command injection vulnerability in the web-based user interface of ALGO 8180 IP Audio Alerter devices, enabling remote code execution. The flaw arises from insufficient validation of user-supplied strings before they are used in system calls, allowing attackers to inject and execute arbitrary commands. Published on 2026-01-23, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).
An authenticated remote attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows execution of arbitrary code in the context of the device, potentially leading to full compromise including high impacts on confidentiality, integrity, and availability.
The Zero Day Initiative advisory ZDI-26-017 provides details on this issue, originally canonized as ZDI-CAN-28321. Security practitioners should review this reference for recommended mitigations and any available patches.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in web-based UI of network device enables remote exploitation of public-facing application (T1190) and arbitrary OS command execution via command interpreter (T1059).